CVEs published April 8, 2025
347 CVEs were published on April 8, 2025: 21 critical, 164 high. 1 is now in CISA KEV.
- Published
- 347
- Critical
- 21
- High
- 164
- Medium
- 148
- Low
- 9
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 163
Most affected products
- Microsoft Windows
- 69
- Adobe ColdFusion
- 15
- Samsung Mobile Devices
- 14
- Rockwell Automation Arena®
- 11
- Adobe Framemaker
- 10
- Linux
- 10
- Siemens SENTRON 7KT PAC1260 Data Manager
- 9
- Adobe After Effects
- 7
- Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1
- 7
- Ivanti Endpoint Manager
- 6
Critical 21
- CVE-2025-22871Request smuggling due to acceptance of invalid chunked data in net/httpGo standard library net/http/internal · stdlib +1
- CVE-2025-30282ColdFusion | Improper Authentication (CWE-287)Adobe ColdFusion
- CVE-2025-24446ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2025-24447ColdFusion | Deserialization of Untrusted Data (CWE-502)Adobe ColdFusion
- CVE-2025-30281ColdFusion | Improper Access Control (CWE-284)Adobe ColdFusion
- CVE-2024-48887A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwordFortinet FortiSwitch
- CVE-2025-25226[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database packageJoomla! Project Joomla! Framework · joomla/database
- CVE-2025-32028HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Executionhaxtheweb issues
- CVE-2025-32020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parserGuichaguri crud-query-parser · crud-query-parser
- CVE-2024-54092A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (AlSiemens Industrial Edge Device Kit - arm64 · Siemens Ind… +9
- CVE-2024-41794A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2024-41790A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2024-41789A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2024-41788A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2025-31330Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)SAP_SE SAP Landscape Transformation
- CVE-2025-30016Authentication Bypass Vulnerability in SAP Financial ConsolidationSAP_SE SAP Financial Consolidation
- CVE-2025-27429Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)SAP_SE SAP S/4HANA
- CVE-2025-2004Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletionwpminds Simple WP Events
- CVE-2025-3363HGiga iSherlock - OS Command InjectionHGiga iSherlock
- CVE-2025-3362HGiga iSherlock - OS Command InjectionHGiga iSherlock
- CVE-2025-3361HGiga iSherlock - OS Command InjectionHGiga iSherlock
High 164
- CVE-2024-12556Kibana Prototype Pollution can lead to code injectionElastic Kibana
- CVE-2025-30287ColdFusion | Improper Authentication (CWE-287)Adobe ColdFusion
- CVE-2025-30290ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2025-30284ColdFusion | Deserialization of Untrusted Data (CWE-502)Adobe ColdFusion
- CVE-2025-30289ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Adobe ColdFusion
- CVE-2025-30288ColdFusion | Improper Access Control (CWE-284)Adobe ColdFusion
- CVE-2025-30285ColdFusion | Deserialization of Untrusted Data (CWE-502)Adobe ColdFusion
- CVE-2025-30286ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Adobe ColdFusion
- CVE-2025-30295Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)Adobe Framemaker
- CVE-2025-30297Adobe Framemaker | Out-of-bounds Write (CWE-787)Adobe Framemaker
- CVE-2025-30304Adobe Framemaker | Out-of-bounds Write (CWE-787)Adobe Framemaker
- CVE-2025-30299Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)Adobe Framemaker
- CVE-2025-30296Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe Framemaker
- CVE-2025-30298Adobe Framemaker | Stack-based Buffer Overflow (CWE-121)Adobe Framemaker
- CVE-2025-27200Animate | Use After Free (CWE-416)Adobe Animate
- CVE-2025-27199Animate | Heap-based Buffer Overflow (CWE-122)Adobe Animate
- CVE-2025-27198Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)Adobe Photoshop Desktop
- CVE-2025-27196Premiere Pro | Heap-based Buffer Overflow (CWE-122)Adobe Premiere Pro
- CVE-2025-27193Bridge | Heap-based Buffer Overflow (CWE-122)Adobe Bridge
- CVE-2025-27195Media Encoder | Heap-based Buffer Overflow (CWE-122)Adobe Media Encoder
- CVE-2025-27194Media Encoder | Out-of-bounds Write (CWE-787)Adobe Media Encoder
- CVE-2025-27182After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2025-27183After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2025-26682ASP.NET Core and Visual Studio Denial of Service VulnerabilityMicrosoft ASP.NET Core · Microsoft Visual Studio
- CVE-2025-24062Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-24060Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-29811Windows Mobile Broadband Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-29816Microsoft Word Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2025-29812DirectX Graphics Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-29810Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-29805Outlook for Android Information Disclosure VulnerabilityMicrosoft Outlook for Android
- CVE-2025-29809Windows Kerberos Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-29804Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2025-29801Microsoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityMicrosoft AutoUpdate for Mac
- CVE-2025-29802Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2025-29800Microsoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityMicrosoft AutoUpdate for Mac
- CVE-2025-27739Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27737Windows Security Zone Mapping Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-27733NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27732Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27730Windows Digital Media Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27731Microsoft OpenSSH for Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27728Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27729Windows Shell Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-27727Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27490Windows Bluetooth Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27491Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-27492Windows Secure Channel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27486Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-27489Azure Local Elevation of Privilege VulnerabilityMicrosoft Azure Stack HCI OS · Microsoft Azure Stack OS HCI
- CVE-2025-27487Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2025-27483NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27482Windows Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2025-27481Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-27480Windows Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2025-27484Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27485Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-27469Windows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-27467Windows Digital Media Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26679RPC Endpoint Mapper Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26678Windows Defender Application Control Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-26675Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26673Windows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-26674Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-26671Windows Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsoft W…
- CVE-2025-26670Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-26652Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-26647Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-26649Windows Secure Channel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26648Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26641Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-26640Windows Digital Media Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26642Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Access +3
- CVE-2025-26639Windows USB Print Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26628Azure Local Cluster Information Disclosure VulnerabilityMicrosoft Azure Local Cluster
- CVE-2025-24058Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21222Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21221Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21204Windows Process Activation Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21205Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-21191Windows Local Security Authority (LSA) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-21174Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-24073Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-24074Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-29823Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2025-29822Microsoft OneNote Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2025-29820Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2025-29794Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-29792Microsoft Office Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-29793Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-29791Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-27750Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-27752Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-27751Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2025-27743Microsoft System Center Elevation of Privilege VulnerabilityMicrosoft System Center Data Protection Manager · Micros… +3
- CVE-2025-27749Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-27747Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2025-27748Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-27746Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2025-27745Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2025-27744Microsoft Office Elevation of Privilege VulnerabilityMicrosoft Office
- CVE-2025-27741NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27740Active Directory Certificate Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-27479Kerberos Key Distribution Proxy Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2025-27478Windows Local Security Authority (LSA) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27477Windows Telephony Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-27475Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27476Windows Digital Media Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27473HTTP.sys Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-27470Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-26688Microsoft Virtual Hard Disk Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26687Win32k Elevation of Privilege VulnerabilityMicrosoft Office for Android · Microsoft Office for Univ… +1
- CVE-2025-26686Windows TCP/IP Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-26680Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-26668Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-26669Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-26666Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-26665Windows upnphost.dll Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26663Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-32117WordPress Widgetize Pages Light plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityOTWthemes Widgetize Pages Light
- CVE-2025-27083Authenticated Command Injection Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS
- CVE-2025-25227[20250402] - Joomla Core - MFA Authentication BypassJoomla! Project Joomla! CMS · joomla/joomla-cms
- CVE-2025-27082Authenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File WriteHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS
- CVE-2025-32018Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docsgetcursor cursor
- CVE-2025-32017Umbraco has a Management API Vulnerability to Path Traversal With Authenticated UsersUmbraco-CMS · Umbraco.Cms
- CVE-2025-3289Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-3288Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-3287Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-3286Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-3285Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-2829Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-2293Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-2288Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-2287Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-2286Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-2285Local Code Execution Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2025-1095IBM Personal Communications command executionIBM Personal Communications
- CVE-2025-22466Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtaIvanti Endpoint Manager
- CVE-2025-22461SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admiIvanti Endpoint Manager
- CVE-2025-22458DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to Ivanti Endpoint Manager
- CVE-2024-26013A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.Fortinet FortiProxy · Fortinet FortiManager +1
- CVE-2024-54024An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolatFortinet FortiIsolator
- CVE-2025-31498c-ares has a use-after-free in read_answers()c-ares
- CVE-2025-30151Shopware allows Denial Of Service via password lengthshopware · shopware/core +1
- CVE-2025-29986Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulneraDell Common Event Enabler
- CVE-2025-2807Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installationstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2024-41793A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2025-3064WPFront User Role Editor <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Functionsyammohanm WPFront User Role Editor
- CVE-2024-41792A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2024-41791A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2025-22015mm/migrate: fix shmem xarray update during migrationLinux
- CVE-2025-22013KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME stateLinux
- CVE-2025-22012Revert "arm64: dts: qcom: sdm845: Affirm IDR0.CCTW on apps_smmu"Linux
- CVE-2025-3431ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File DownloadZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- CVE-2025-30014Directory Traversal vulnerability in SAP Capital Yield Tax ManagementSAP_SE SAP Capital Yield Tax Management
- CVE-2025-27428Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)SAP_SE SAP NetWeaver and ABAP Platform
- CVE-2025-23186Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAPSAP_SE SAP NetWeaver Application Server ABAP
- CVE-2025-20946Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prior to SMR Apr-2025 ReSamsung Mobile Devices
- CVE-2025-20936Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their priviSamsung Mobile Devices
- CVE-2025-2525Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Uploadiqonicdesign Streamit
- CVE-2025-2526Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeoveriqonicdesign Streamit
- CVE-2024-55354Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism faiLucee Server
- CVE-2025-32406An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch NAKIVO Backup & Replication Director
Medium, low and unrated 162
- CVE-2025-25013Elastic Defend Insertion of Sensitive Information into Log FilesElastic Defend
- CVE-2025-27190Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/project-community-edition +1
- CVE-2025-27191Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/project-community-edition +1
- CVE-2025-27192Adobe Commerce | Insufficiently Protected Credentials (CWE-522)Adobe Commerce · magento/project-community-edition +1
- CVE-2025-27188Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition
- CVE-2025-27189Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)Adobe Commerce
- CVE-2025-30293ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2025-30292ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe ColdFusion
- CVE-2025-30294ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2025-30291ColdFusion | Information Exposure (CWE-200)Adobe ColdFusion
- CVE-2025-3416Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`rust-openssl · Red Hat Directory Server +4
- CVE-2025-30308XMPWorker | Out-of-bounds Read (CWE-125)Adobe XMPWorker
- CVE-2025-30307XMPWorker | Out-of-bounds Read (CWE-125)Adobe XMPWorker
- CVE-2025-30305XMPWorker | Out-of-bounds Read (CWE-125)Adobe XMPWorker
- CVE-2025-30306XMPWorker | Out-of-bounds Read (CWE-125)Adobe XMPWorker
- CVE-2025-30309XMPWorker | Out-of-bounds Read (CWE-125)Adobe XMPWorker
- CVE-2025-30300Adobe Framemaker | NULL Pointer Dereference (CWE-476)Adobe Framemaker
- CVE-2025-30303Adobe Framemaker | Out-of-bounds Read (CWE-125)Adobe Framemaker
- CVE-2025-30301Adobe Framemaker | NULL Pointer Dereference (CWE-476)Adobe Framemaker
- CVE-2025-30302Adobe Framemaker | Out-of-bounds Read (CWE-125)Adobe Framemaker
- CVE-2025-27205Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-32036DNN allows the possibility of bypassing Captchadnnsoftware Dnn.Platform
- CVE-2025-32035DNN does not check the contents of a file when uploading filesdnnsoftware Dnn.Platform
- CVE-2025-27201Animate | Out-of-bounds Read (CWE-125)Adobe Animate
- CVE-2025-27202Animate | Out-of-bounds Read (CWE-125)Adobe Animate
- CVE-2025-27184After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-27186After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-27185After Effects | NULL Pointer Dereference (CWE-476)Adobe After Effects
- CVE-2025-27187After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-27204After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2025-29819Windows Admin Center in Azure Portal Information Disclosure VulnerabilityMicrosoft Windows Admin Center
- CVE-2025-29808Windows Cryptographic Services Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2025-27738Windows Resilient File System (ReFS) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-27736Windows Power Dependency Coordinator Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-27735Windows Virtualization-Based Security (VBS) Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-26676Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-26672Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-26651Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-26644Windows Hello Spoofing VulnerabilityMicrosoft Windows
- CVE-2025-26637Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-26635Windows Hello Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-25002Azure Local Cluster Information Disclosure VulnerabilityMicrosoft Azure Local Cluster
- CVE-2025-21203Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-21197Windows NTFS Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-29821Microsoft Dynamics Business Central Information Disclosure VulnerabilityMicrosoft Dynamics 365 Business Central 2023 Wave · Micr… +2
- CVE-2025-27742NTFS Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2025-27474Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-27472Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2025-27471Microsoft Streaming Service Denial of Service VulnerabilityMicrosoft Windows
- CVE-2025-26681Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-26667Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-26664Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2025-32279WordPress Live Forms plugin <= 4.8.5 - Broken Access Control vulnerabilityShahjada Live Forms
- CVE-2025-32211WordPress Broadstreet plugin <= 1.52.1 - Cross Site Scripting (XSS) vulnerabilityBroadstreet Ads
- CVE-2025-32164WordPress m1.DownloadList plugin <= 0.24 - Sensitive Data Exposure vulnerabilitymaennchen1.de m1.DownloadList
- CVE-2024-52981An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection oElasticsearch · org.elasticsearch:elasticsearch
- CVE-2024-52974An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash.Elastic Kibana
- CVE-2024-52980Elasticsearch Uncontrolled Resource Consumption vulnerabilityElasticsearch · org.elasticsearch:elasticsearch-grok
- CVE-2025-27084Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal (CP) of an AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS
- CVE-2025-27085Arbitrary File Download Vulnerabilities in Web-Based Management Interface of AOS-10 GW and AOS-8 Controller/Mobility ConductorHewlett Packard Enterprise (HPE) HPE Aruba Networking AOS
- CVE-2025-30671Zoom Workplace Apps for Windows - Null PointerZoom Communications Zoom Workplace Apps for Windows
- CVE-2025-30670Zoom Workplace Apps for Windows - Null PointerZoom Communications Zoom Workplace Apps for Windows
- CVE-2025-27443Zoom Workplace Apps for Windows - Insecure Default Variable InitializationZoom Communications Zoom Workplace Apps for Windows
- CVE-2025-27442Zoom Workplace Apps - Cross Site ScriptingZoom Communications Zoom Workplace Apps
- CVE-2025-27441Zoom Workplace Apps - Cross Site ScriptingZoom Communications Zoom Workplace Apps
- CVE-2025-27079Arbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI InterfaceHewlett Packard Enterprise (HPE) AOS-10 AP
- CVE-2025-27078Authenticated Remote Command Execution caused by Insecure Function Usage in System BinaryHewlett Packard Enterprise (HPE) AOS-10 AP
- CVE-2025-32026Element Web could load a malicious instance of Element Call leaking media encryption keyselement-hq element-web
- CVE-2025-32025bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsingbep imagemeta · github.com/bep/imagemeta
- CVE-2025-32024bep/imagemeta allows excessively large EXIF data structuresbep imagemeta · github.com/bep/imagemeta
- CVE-2025-22465Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execIvanti Endpoint Manager
- CVE-2025-22464An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacIvanti Endpoint Manager
- CVE-2025-22459Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticateIvanti Endpoint Manager
- CVE-2024-50565A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.Fortinet FortiOS · Fortinet FortiVoice +2
- CVE-2023-37930Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in FFortinet FortiProxy · Fortinet FortiOS
- CVE-2024-52962An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, versioFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2024-46671An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below,Fortinet FortiWeb
- CVE-2024-32122A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, ForFortinet FortiOS
- CVE-2024-54025An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolatFortinet FortiIsolator
- CVE-2025-25254An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and belowFortinet FortiWeb
- CVE-2025-22855An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient beforFortinet FortiClientEMS
- CVE-2025-30150Shopware 6 allows attackers to check for registered accounts through the store-apishopware · shopware/core +1
- CVE-2025-2876MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User DeletionMelaPress Login Security Premium · MelaPress Login Security
- CVE-2025-2568Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Updatethemehunk Vayu Blocks – Gutenberg Blocks for WordPress & Wo…
- CVE-2025-30166Pimcore's Admin Classic Bundle allows HTML Injectionpimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2025-29985Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the Dell Common Event Enabler
- CVE-2025-2883Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposurezealopensource Accept SagePay Payments Using Contact Form
- CVE-2025-3437Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-upstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2025-2808Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scriptingstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2025-30280A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), MendiSiemens Mendix Runtime
- CVE-2025-30000A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3).Siemens License Server
- CVE-2025-29999A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3).Siemens License Server
- CVE-2024-41796A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2024-41795A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).Siemens SENTRON 7KT PAC1260 Data Manager
- CVE-2025-3436coreActivity: Activity Logging for WordPress <= 2.7 - Authenticated (Subscriber+) SQL Injectiongdragon coreActivity: Activity Logging for WordPress
- CVE-2025-3433Advanced Advertising System <= 1.3.1 - Open Redirectsmartdevth Advanced Advertising System
- CVE-2025-3432AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scriptingelpix AAWP Obfuscator
- CVE-2025-22017devlink: fix xa_alloc_cyclic() error handlingLinux
- CVE-2025-22016dpll: fix xa_alloc_cyclic() error handlingLinux
- CVE-2025-22014soc: qcom: pdr: Fix the potential deadlockLinux
- CVE-2025-22011ARM: dts: bcm2711: Fix xHCI power-domainLinux
- CVE-2025-22010RDMA/hns: Fix soft lockup during bt pages loopLinux
- CVE-2025-22009regulator: dummy: force synchronous probingLinux
- CVE-2025-22008regulator: check that dummy regulator has been probed before using itLinux
- CVE-2025-2882GreenPay(tm) by Green.Money 3.0.0 - 3.0.9 - Unauthenticated Information Exposuregreenmoney GreenPay(tm) by Green.Money
- CVE-2025-31333Odata meta-data tampering in SAP S4CORE entitySAP_SE SAP S4CORE entity
- CVE-2025-31332Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2025-31331Authorization Bypass vulnerability in SAP NetWeaverSAP_SE SAP NetWeaver
- CVE-2025-30017Missing Authorization check in SAP Solution ManagerSAP_SE SAP Solution Manager
- CVE-2025-30015Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)SAP_SE SAP NetWeaver and ABAP Platform
- CVE-2025-30013Code Injection vulnerability in SAP ERP BW Business ContentSAP_SE SAP ERP BW Business Content
- CVE-2025-27437Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)SAP_SE SAP NetWeaver Application Server ABAP
- CVE-2025-27435Information Disclosure Vulnerability in SAP Commerce CloudSAP_SE SAP Commerce Cloud
- CVE-2025-26657Information Disclosure vulnerability in SAP KMC WPCSAP_SE SAP KMC WPC
- CVE-2025-26654Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)SAP_SE SAP Commerce Cloud
- CVE-2025-26653Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)SAP_SE SAP NetWeaver Application Server ABAP
- CVE-2025-34283DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating_text'fuzzoid 3DPrint Lite
- CVE-2019-25223Team Circle Image Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injectionnik00726 Team Circle Image Slider With Lightbox
- CVE-2025-34303DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'printer_text'fuzzoid 3DPrint Lite
- CVE-2025-34293DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text'fuzzoid 3DPrint Lite
- CVE-2025-34273DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'fuzzoid 3DPrint Lite
- CVE-2025-3413opplus springboot-admin SysGeneratorController.java code deserializationopplus springboot-admin
- CVE-2025-0361During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration frAxis Communications AB AXIS OS
- CVE-2024-4726151l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validAxis Communications AB AXIS OS
- CVE-2025-3412mymagicpower AIAS InferController.java server-side request forgerymymagicpower AIAS
- CVE-2025-3411mymagicpower AIAS AsrController.java server-side request forgerymymagicpower AIAS
- CVE-2025-3410mymagicpower AIAS LocalStorageController.java unrestricted uploadmymagicpower AIAS
- CVE-2025-20939Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update devSamsung Mobile Devices
- CVE-2025-20951Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to writSamsung Mobile Galaxy Store
- CVE-2025-20950Use of implicit intent for sensitive communication in SamsungNotes prior to version 4.4.26.45 allows local attackers to access sensitive infSamsung Mobile SamsungNotes
- CVE-2025-20948Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read ouSamsung Mobile Devices
- CVE-2025-20947Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to accSamsung Mobile Devices
- CVE-2025-20945Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watSamsung Mobile Devices
- CVE-2025-20944Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memorySamsung Mobile Devices
- CVE-2025-20943Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2025-20942Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAISamsung Mobile Devices
- CVE-2025-20941Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device.Samsung Mobile Devices
- CVE-2025-20940Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackersSamsung Mobile Devices
- CVE-2025-20938Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContactSamsung Mobile Devices
- CVE-2025-20935Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to accSamsung Mobile Devices
- CVE-2025-20934Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilegeSamsung Mobile Devices
- CVE-2025-3409Nothings stb stb_include_string stack-based overflowNothings stb
- CVE-2024-13820Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hashmelhorenvio Melhor Envio
- CVE-2025-3408Nothings stb stb_dupreplace integer overflowNothings stb
- CVE-2025-3407Nothings stb stbhw_build_tileset_from_image out-of-boundsNothings stb
- CVE-2025-3406Nothings stb Header Array stbhw_build_tileset_from_image out-of-boundsNothings stb
- CVE-2025-3405FCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injectionFCJ Venture Builder appclientefiel
- CVE-2025-3403Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in sourceVivotek NVR ND8422P · Vivotek NVR ND9525P +1
- CVE-2025-3402Seeyon Zhiyuan Interconnect FE Collaborative Office Platform check.js%70 sql injectionSeeyon Zhiyuan Interconnect FE Collaborative Office Platform
- CVE-2025-3401ESAFENET CDG getLimitIPList.jsp sql injectionESAFENET CDG
- CVE-2025-3364HGiga PowerStation - Chroot EscapeHGiga PowerStation
- CVE-2025-3400ESAFENET CDG UnChkMailApplication.jsp sql injectionESAFENET CDG
- CVE-2025-3399ESAFENET CDG updateNotice.jsp sql injectionESAFENET CDG
- CVE-2025-2519Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Downloadiqonicdesign Streamit
- CVE-2025-3398lenve VBlog WebSecurityConfig.java configure access controllenve VBlog
- CVE-2025-3397YzmCMS message.tpl cross site scriptingYzmCMS
- CVE-2025-3393mrcen springboot-ucan-admin Personal Settings Interface index cross site scriptingmrcen springboot-ucan-admin
- CVE-2025-3392hailey888 oa_system Backend MailController.java save cross site scriptinghailey888 oa_system
- CVE-2025-3391hailey888 oa_system Backend AddrController. java outAddress cross site scriptinghailey888 oa_system
- CVE-2025-3390hailey888 oa_system Backend DaymanageController.java addandchangeday cross site scriptinghailey888 oa_system
- CVE-2025-32413Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.CIRCL Vulnerability-Lookup
- CVE-2025-32414In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an ixmlsoft libxml2