CVEs published April 7, 2025
169 CVEs were published on April 7, 2025: 10 critical, 60 high. 1 is now in CISA KEV.
- Published
- 169
- Critical
- 10
- High
- 60
- Medium
- 89
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- Qualcomm Snapdragon
- 34
- codeprojects Online Restaurant Management System
- 16
- Huawei HarmonyOS
- 14
- PCMan FTP Server
- 11
- OpenHarmony
- 7
- Huawei HarmonyOS · Huawei EMUI
- 6
- MediaTek MT9972
- 4
- apollographql router · apollo-router
- 3
- PHPGurukul Old Age Home Management System
- 3
- AmauriC tarteaucitron.js · tarteaucitronjs
- 2
Critical 10
- CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codelangflow-ai langflow · langflow +1
- CVE-2025-20654In wlan service, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6890, MT7622, MT7915, MT7916, MT7981, MT7986
- CVE-2025-28402An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
- CVE-2025-28405An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
- CVE-2025-28406An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
- CVE-2025-28408An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endp
- CVE-2025-28410An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whethe
- CVE-2025-28411An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
- CVE-2025-28412An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
- CVE-2025-28413An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
High 60
- CVE-2025-0942Jalios JPlatform 10 SP6 < 10.0.6 Record Chooser SQL InjectionJalios JPlatform
- CVE-2025-32034Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansionapollographql router · apollo-router
- CVE-2025-32033Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflowapollographql router · apollo-router
- CVE-2025-32032Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypassapollographql router · apollo-router
- CVE-2025-32031Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypassapollographql federation · @apollo/gateway
- CVE-2025-32030Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansionapollographql federation · @apollo/gateway
- CVE-2025-31496apollo-compiler Named Fragment Processing Vulnerabilityapollographql apollo-rs · apollo-compiler
- CVE-2025-29769libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF outputlibvips
- CVE-2025-3426Use of default hardcoded credentialsPhilips IntelliSpace Portal · Philips Advanced Visualizatio…
- CVE-2025-3425Unauthenticated Remote Code Execution via .NET DeserializationPhilips IntelliSpace Portal
- CVE-2025-34243.2.1 Arbitrary File Read in insecure .NET Remoting TCP ChannelPhilips IntelliSpace Portal
- CVE-2025-30195A crafted zone can lead to an illegal memory access in the PowerDNS RecursorPowerDNS Recursor
- CVE-2025-21448Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2025-21447Improper Validation of Array Index in Computer VisionQualcomm Snapdragon
- CVE-2025-21443Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Automotive Vehicle NetworksQualcomm Snapdragon
- CVE-2025-21442Integer Overflow to Buffer Overflow in Automotive Vehicle NetworksQualcomm Snapdragon
- CVE-2025-21441Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21440Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21439Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21438Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21437Use After Free in Automotive Linux OSQualcomm Snapdragon
- CVE-2025-21436Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2025-21435Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2025-21434Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21430Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21429Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21428Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21425Improper Access Control in Automotive Linux OSQualcomm Snapdragon
- CVE-2025-21423Improper Validation of Array Index in DisplayQualcomm Snapdragon
- CVE-2025-21421Buffer Over-read in DisplayQualcomm Snapdragon
- CVE-2024-45557Use of Out-of-range Pointer Offset in Trust Management EngineQualcomm Snapdragon
- CVE-2024-45552Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-45549Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNELQualcomm Snapdragon
- CVE-2024-43067Time-of-check Time-of-use (TOCTOU) Race Condition in CameraQualcomm Snapdragon
- CVE-2024-43066Use After Free in HLOSQualcomm Snapdragon
- CVE-2024-43065Exposed Dangerous Method or Function in HLOSQualcomm Snapdragon
- CVE-2024-43058Incorrect Type Conversion or Cast in Multimedia FrameworksQualcomm Snapdragon
- CVE-2024-33058Insufficient Granularity of Access Control in CoreQualcomm Snapdragon
- CVE-2025-3346Tenda AC7 SetPptpServerCfg formSetPPTPServer buffer overflowTenda AC7
- CVE-2025-30473Apache Airflow Common SQL Provider: Remote Code Execution via Sql InjectionApache Software Foundation Apache Airflow Common SQL Provid…
- CVE-2024-11859DLL Search Order Hijacking in ESET products for WindowsESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +9
- CVE-2024-11071Improper Access Control In DestinyECMCyberdigm DestinyECM
- CVE-2025-31175Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service integHuawei HarmonyOS · Huawei EMUI
- CVE-2025-31173Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect serHuawei HarmonyOS
- CVE-2025-31172Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect serHuawei HarmonyOS
- CVE-2025-31170Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrityHuawei HarmonyOS · Huawei EMUI
- CVE-2024-58127Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrityHuawei HarmonyOS · Huawei EMUI
- CVE-2024-58126Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrityHuawei HarmonyOS · Huawei EMUI
- CVE-2024-58125Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrityHuawei HarmonyOS · Huawei EMUI
- CVE-2024-58124Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrityHuawei HarmonyOS · Huawei EMUI
- CVE-2024-58112Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliHuawei HarmonyOS
- CVE-2024-58111Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliHuawei HarmonyOS
- CVE-2024-58107Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2025-20664In wlan AP driver, there is a possible information disclosure due to an uncaught exception.MediaTek MT7915, MT7916, MT7981, MT7986, MT7990, MT7992
- CVE-2025-20663In wlan AP driver, there is a possible information disclosure due to an uncaught exception.MediaTek MT7915, MT7916, MT7981, MT7986
- CVE-2025-3328Tenda AC1206 fast_setting_wifi_set form_fast_setting_wifi_set buffer overflowTenda AC1206
- CVE-2025-28403An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the req
- CVE-2025-28407An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not proper
- CVE-2025-28409An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not proper
- CVE-2025-32409Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) cRatta SuperNote A6 X2 Nomad
Medium, low and unrated 99
- CVE-2025-3389hailey888 oa_system Backend InformManageController.java testMess cross site scriptinghailey888 oa_system
- CVE-2025-3388hailey888 oa_system Frontend LoginsController.java loginCheck cross site scriptinghailey888 oa_system
- CVE-2025-3387renrenio renren-security JSON cross site scriptingrenrenio renren-security
- CVE-2025-3386LinZhaoguan pb-cms Friendship Link admin#links cross site scriptingLinZhaoguan pb-cms
- CVE-2025-3385LinZhaoguan pb-cms Classification Management Page cross site scriptingLinZhaoguan pb-cms
- CVE-2025-33841000 Projects Human Resource Management System employee.php sql injection1000 Projects Human Resource Management System
- CVE-2025-3383SourceCodester Web-based Pharmacy Product Management System search_sales.php sql injectionSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-32029ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value RepresentationApelegHQ ts-asn1-der · @apeleghq/asn1-der
- CVE-2025-3382joey-zhou xiaozhi-esp32-server-java update sql injectionjoey-zhou xiaozhi-esp32-server-java
- CVE-2025-3381zhangyanbo2007 youkefu File Upload WebIMController.java path traversalzhangyanbo2007 youkefu
- CVE-2025-3380PCMan FTP Server FEAT Command buffer overflowPCMan FTP Server
- CVE-2025-3379PCMan FTP Server EPSV Command buffer overflowPCMan FTP Server
- CVE-2025-3378PCMan FTP Server EPRT Command buffer overflowPCMan FTP Server
- CVE-2025-3377PCMan FTP Server ENC Command buffer overflowPCMan FTP Server
- CVE-2024-38797Out-of-bounds Read in HashPeImageByType()TianoCore EDK2
- CVE-2025-3376PCMan FTP Server CONF Command buffer overflowPCMan FTP Server
- CVE-2025-3375PCMan FTP Server CDUP Command buffer overflowPCMan FTP Server
- CVE-2025-3374PCMan FTP Server CCC Command buffer overflowPCMan FTP Server
- CVE-2025-3373PCMan FTP Server SITE CHMOD Command buffer overflowPCMan FTP Server
- CVE-2025-3372PCMan FTP Server MKDIR Command buffer overflowPCMan FTP Server
- CVE-2025-32014estree-util-value-to-estree allows prototype pollution in generated ESTreeremcohaszing estree-util-value-to-estree · estree-util-valu…
- CVE-2025-31476tarteaucitron.js allows url scheme injection via unfiltered inputsAmauriC tarteaucitron.js · tarteaucitronjs +1
- CVE-2025-31475tarteaucitron.js allows prototype pollution via custom text injectionAmauriC tarteaucitron.js · tarteaucitronjs
- CVE-2025-31138tarteaucitron.js allows UI manipulation via unrestricted CSS injectionAmauriC tarteaucitron.js · tarteaucitronjs
- CVE-2025-30373Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong valuegraylog2-server · org.graylog2:graylog2-server
- CVE-2025-3371PCMan FTP Server DELETE Command buffer overflowPCMan FTP Server
- CVE-2025-2251Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code executionwildfly · Red Hat JBoss Enterprise Application Platform
- CVE-2025-3370PHPGurukul Men Salon Management System admin-profile.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3369xxyopen Novel-Plus list sql injectionxxyopen Novel-Plus
- CVE-2025-27686Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper NeutralizaDell Unisphere for PowerMax
- CVE-2025-3353PHPGurukul Men Salon Management System add-services.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3360Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().glib · Red Hat Enterprise Linux
- CVE-2025-3359Gnuplot: segmentation fault via io_str_init_static_internal functiongnuplot · Red Hat Enterprise Linux
- CVE-2025-3352PHPGurukul Old Age Home Management System edit-scdetails.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-0050Mali GPU Userspace Driver allows an Out-of-Bounds accessArm Valhall GPU Userspace Driver · Arm 5th Gen GPU Arch… +1
- CVE-2025-3351PHPGurukul Old Age Home Management System login.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-3350PHPGurukul Old Age Home Management System view-enquiry.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-3349PCMan FTP Server SYST Command buffer overflowPCMan FTP Server
- CVE-2025-3348code-projects Patient Record Management System edit_dpatient.php sql injectioncode-projects Patient Record Management System
- CVE-2025-21431Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-49848Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2024-45556Improper Access Control for Register Interface in TZ FirmwareQualcomm Snapdragon
- CVE-2024-45551Weak Authentication in HLOSQualcomm Snapdragon
- CVE-2024-45544Use After Free in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-45543Out-of-bounds Write in AudioQualcomm Snapdragon
- CVE-2024-45540Use After Free in HLOSQualcomm Snapdragon
- CVE-2024-43046Information Exposure in TZ Secure OSQualcomm Snapdragon
- CVE-2025-3347code-projects Patient Record Management System dental_pending.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3345codeprojects Online Restaurant Management System combo.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3344codeprojects Online Restaurant Management System assign_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3343codeprojects Online Restaurant Management System reservation_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3342codeprojects Online Restaurant Management System payment_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3341codeprojects Online Restaurant Management System reservation_view.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3340codeprojects Online Restaurant Management System combo_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3339codeprojects Online Restaurant Management System user_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3338codeprojects Online Restaurant Management System user_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3337codeprojects Online Restaurant Management System member_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3336codeprojects Online Restaurant Management System member_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3335codeprojects Online Restaurant Management System category_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-31174Path traversal vulnerability in the DFS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS
- CVE-2025-31171File read permission bypass vulnerability in the kernel file system module Impact: Successful exploitation of this vulnerability may affect Huawei HarmonyOS
- CVE-2024-58116Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affHuawei HarmonyOS
- CVE-2024-58115Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affHuawei HarmonyOS
- CVE-2024-58113Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affeHuawei HarmonyOS
- CVE-2024-58110Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2024-58109Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2024-58108Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2024-58106Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2025-3334codeprojects Online Restaurant Management System category_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-20662In PlayReady TA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-20661In PlayReady TA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-20660In PlayReady TA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-20659In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT2737, MT6739, MT6761, MT6762, MT6762D, M…
- CVE-2025-20658In DA, there is a possible permission bypass due to a logic error.MediaTek MT2718, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2025-20657In vdec, there is a possible permission bypass due to improper input validation.MediaTek MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT…
- CVE-2025-20656In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…
- CVE-2025-20655In keymaster, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-3333codeprojects Online Restaurant Management System menu_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-27534arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-25057third_party_NuttX has a memory leak vulnerabilityOpenHarmony
- CVE-2025-24304arkcompiler_ets_runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-22851Liteos_A has an integer overflow vulnerabilityOpenHarmony
- CVE-2025-22842arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-22452arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-20102arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-3332codeprojects Online Restaurant Management System menu_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3331codeprojects Online Restaurant Management System payment_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3330codeprojects Online Restaurant Management System reservation_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3329Consumer Comanda Mobile Restaurant Order cleartext transmissionConsumer Comanda Mobile
- CVE-2025-3327iteaj iboot 物联网网关 File Upload batch cross site scriptingiteaj iboot 物联网网关
- CVE-2024-46494A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2025-28400An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
- CVE-2025-28401An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
- CVE-2025-29087In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocaSQLite
- CVE-2025-29478An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
- CVE-2025-29480Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release functgdal
- CVE-2025-29481Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog` function of l
- CVE-2025-29482Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset) proce
- CVE-2025-29594A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately valida