# CVEs published 2025-04-08

347 CVEs were published on April 8, 2025: 21 critical, 164 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-25013](https://cve.now/CVE-2025-25013.md): Elastic Defend Insertion of Sensitive Information into Log Files (CVSS 6.5, Elastic Defend)
- [CVE-2025-27190](https://cve.now/CVE-2025-27190.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 5.3, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2025-27191](https://cve.now/CVE-2025-27191.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 5.3, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2025-27192](https://cve.now/CVE-2025-27192.md): Adobe Commerce | Insufficiently Protected Credentials (CWE-522) (CVSS 2.7, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2025-27188](https://cve.now/CVE-2025-27188.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2025-27189](https://cve.now/CVE-2025-27189.md): Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) (CVSS 4.3, Adobe Commerce)
- [CVE-2025-22871](https://cve.now/CVE-2025-22871.md): Request smuggling due to acceptance of invalid chunked data in net/http (CVSS 9.1, Go standard library net/http/internal · stdlib +1)
- [CVE-2024-12556](https://cve.now/CVE-2024-12556.md): Kibana Prototype Pollution can lead to code injection (CVSS 8.7, Elastic Kibana)
- [CVE-2025-30287](https://cve.now/CVE-2025-30287.md): ColdFusion | Improper Authentication (CWE-287) (CVSS 8.2, Adobe ColdFusion)
- [CVE-2025-30293](https://cve.now/CVE-2025-30293.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 6.8, Adobe ColdFusion)
- [CVE-2025-30292](https://cve.now/CVE-2025-30292.md): ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe ColdFusion)
- [CVE-2025-30290](https://cve.now/CVE-2025-30290.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.7, Adobe ColdFusion)
- [CVE-2025-30282](https://cve.now/CVE-2025-30282.md): ColdFusion | Improper Authentication (CWE-287) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-30284](https://cve.now/CVE-2025-30284.md): ColdFusion | Deserialization of Untrusted Data (CWE-502) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2025-30294](https://cve.now/CVE-2025-30294.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 6.8, Adobe ColdFusion)
- [CVE-2025-30289](https://cve.now/CVE-2025-30289.md): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 8.2, Adobe ColdFusion)
- [CVE-2025-30288](https://cve.now/CVE-2025-30288.md): ColdFusion | Improper Access Control (CWE-284) (CVSS 8.2, Adobe ColdFusion)
- [CVE-2025-24446](https://cve.now/CVE-2025-24446.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-24447](https://cve.now/CVE-2025-24447.md): ColdFusion | Deserialization of Untrusted Data (CWE-502) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-30281](https://cve.now/CVE-2025-30281.md): ColdFusion | Improper Access Control (CWE-284) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-30291](https://cve.now/CVE-2025-30291.md): ColdFusion | Information Exposure (CWE-200) (CVSS 5.5, Adobe ColdFusion)
- [CVE-2025-30285](https://cve.now/CVE-2025-30285.md): ColdFusion | Deserialization of Untrusted Data (CWE-502) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2025-30286](https://cve.now/CVE-2025-30286.md): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2025-3416](https://cve.now/CVE-2025-3416.md): Rust-openssl: rust-openssl use-after-free in \`md::fetch\` and \`cipher::fetch\` (CVSS 3.7, rust-openssl · Red Hat Directory Server +4)
- [CVE-2025-30308](https://cve.now/CVE-2025-30308.md): XMPWorker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe XMPWorker)
- [CVE-2025-30307](https://cve.now/CVE-2025-30307.md): XMPWorker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe XMPWorker)
- [CVE-2025-30305](https://cve.now/CVE-2025-30305.md): XMPWorker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe XMPWorker)
- [CVE-2025-30306](https://cve.now/CVE-2025-30306.md): XMPWorker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe XMPWorker)
- [CVE-2025-30309](https://cve.now/CVE-2025-30309.md): XMPWorker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe XMPWorker)
- [CVE-2025-30300](https://cve.now/CVE-2025-30300.md): Adobe Framemaker | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Framemaker)
- [CVE-2025-30303](https://cve.now/CVE-2025-30303.md): Adobe Framemaker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Framemaker)
- [CVE-2025-30295](https://cve.now/CVE-2025-30295.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-30297](https://cve.now/CVE-2025-30297.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-30304](https://cve.now/CVE-2025-30304.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-30301](https://cve.now/CVE-2025-30301.md): Adobe Framemaker | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Framemaker)
- [CVE-2025-30302](https://cve.now/CVE-2025-30302.md): Adobe Framemaker | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Framemaker)
- [CVE-2025-30299](https://cve.now/CVE-2025-30299.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-30296](https://cve.now/CVE-2025-30296.md): Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-30298](https://cve.now/CVE-2025-30298.md): Adobe Framemaker | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-27205](https://cve.now/CVE-2025-27205.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-32036](https://cve.now/CVE-2025-32036.md): DNN allows the possibility of bypassing Captcha (CVSS 4.2, dnnsoftware Dnn.Platform)
- [CVE-2025-32035](https://cve.now/CVE-2025-32035.md): DNN does not check the contents of a file when uploading files (CVSS 2.6, dnnsoftware Dnn.Platform)
- [CVE-2025-27201](https://cve.now/CVE-2025-27201.md): Animate | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Animate)
- [CVE-2025-27200](https://cve.now/CVE-2025-27200.md): Animate | Use After Free (CWE-416) (CVSS 7.8, Adobe Animate)
- [CVE-2025-27199](https://cve.now/CVE-2025-27199.md): Animate | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Animate)
- [CVE-2025-27202](https://cve.now/CVE-2025-27202.md): Animate | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Animate)
- [CVE-2025-27198](https://cve.now/CVE-2025-27198.md): Photoshop Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2025-27196](https://cve.now/CVE-2025-27196.md): Premiere Pro | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2025-27193](https://cve.now/CVE-2025-27193.md): Bridge | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Bridge)
- [CVE-2025-27195](https://cve.now/CVE-2025-27195.md): Media Encoder | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Media Encoder)
- [CVE-2025-27194](https://cve.now/CVE-2025-27194.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder)
- [CVE-2025-27184](https://cve.now/CVE-2025-27184.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-27182](https://cve.now/CVE-2025-27182.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2025-27186](https://cve.now/CVE-2025-27186.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-27185](https://cve.now/CVE-2025-27185.md): After Effects | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-27187](https://cve.now/CVE-2025-27187.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-27183](https://cve.now/CVE-2025-27183.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2025-27204](https://cve.now/CVE-2025-27204.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-26682](https://cve.now/CVE-2025-26682.md): ASP.NET Core and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft ASP.NET Core · Microsoft Visual Studio)
- [CVE-2025-24062](https://cve.now/CVE-2025-24062.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24060](https://cve.now/CVE-2025-24060.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-29811](https://cve.now/CVE-2025-29811.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-29819](https://cve.now/CVE-2025-29819.md): Windows Admin Center in Azure Portal Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows Admin Center)
- [CVE-2025-29816](https://cve.now/CVE-2025-29816.md): Microsoft Word Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-29812](https://cve.now/CVE-2025-29812.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-29810](https://cve.now/CVE-2025-29810.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-29805](https://cve.now/CVE-2025-29805.md): Outlook for Android Information Disclosure Vulnerability (CVSS 7.5, Microsoft Outlook for Android)
- [CVE-2025-29808](https://cve.now/CVE-2025-29808.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2025-29809](https://cve.now/CVE-2025-29809.md): Windows Kerberos Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-29804](https://cve.now/CVE-2025-29804.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio)
- [CVE-2025-29801](https://cve.now/CVE-2025-29801.md): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft AutoUpdate for Mac)
- [CVE-2025-29802](https://cve.now/CVE-2025-29802.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio)
- [CVE-2025-29800](https://cve.now/CVE-2025-29800.md): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft AutoUpdate for Mac)
- [CVE-2025-27739](https://cve.now/CVE-2025-27739.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27738](https://cve.now/CVE-2025-27738.md): Windows Resilient File System (ReFS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-27737](https://cve.now/CVE-2025-27737.md): Windows Security Zone Mapping Security Feature Bypass Vulnerability (CVSS 8.6, Microsoft Windows)
- [CVE-2025-27736](https://cve.now/CVE-2025-27736.md): Windows Power Dependency Coordinator Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-27735](https://cve.now/CVE-2025-27735.md): Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability (CVSS 6.0, Microsoft Windows)
- [CVE-2025-27733](https://cve.now/CVE-2025-27733.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27732](https://cve.now/CVE-2025-27732.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-27730](https://cve.now/CVE-2025-27730.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27731](https://cve.now/CVE-2025-27731.md): Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27728](https://cve.now/CVE-2025-27728.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27729](https://cve.now/CVE-2025-27729.md): Windows Shell Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27727](https://cve.now/CVE-2025-27727.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27490](https://cve.now/CVE-2025-27490.md): Windows Bluetooth Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27491](https://cve.now/CVE-2025-27491.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-27492](https://cve.now/CVE-2025-27492.md): Windows Secure Channel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-27486](https://cve.now/CVE-2025-27486.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-27489](https://cve.now/CVE-2025-27489.md): Azure Local Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Stack HCI OS · Microsoft Azure Stack OS HCI)
- [CVE-2025-27487](https://cve.now/CVE-2025-27487.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2025-27483](https://cve.now/CVE-2025-27483.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27482](https://cve.now/CVE-2025-27482.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2025-27481](https://cve.now/CVE-2025-27481.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-27480](https://cve.now/CVE-2025-27480.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2025-27484](https://cve.now/CVE-2025-27484.md): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-27485](https://cve.now/CVE-2025-27485.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-27469](https://cve.now/CVE-2025-27469.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-27467](https://cve.now/CVE-2025-27467.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26679](https://cve.now/CVE-2025-26679.md): RPC Endpoint Mapper Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26678](https://cve.now/CVE-2025-26678.md): Windows Defender Application Control Security Feature Bypass Vulnerability (CVSS 8.4, Microsoft Windows)
- [CVE-2025-26676](https://cve.now/CVE-2025-26676.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-26675](https://cve.now/CVE-2025-26675.md): Windows Subsystem for Linux Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26673](https://cve.now/CVE-2025-26673.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-26672](https://cve.now/CVE-2025-26672.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-26674](https://cve.now/CVE-2025-26674.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26671](https://cve.now/CVE-2025-26671.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 R2 Service Pack · Microsoft W…)
- [CVE-2025-26670](https://cve.now/CVE-2025-26670.md): Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2025-26652](https://cve.now/CVE-2025-26652.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-26651](https://cve.now/CVE-2025-26651.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-26647](https://cve.now/CVE-2025-26647.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-26649](https://cve.now/CVE-2025-26649.md): Windows Secure Channel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-26648](https://cve.now/CVE-2025-26648.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26644](https://cve.now/CVE-2025-26644.md): Windows Hello Spoofing Vulnerability (CVSS 5.1, Microsoft Windows)
- [CVE-2025-26641](https://cve.now/CVE-2025-26641.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-26640](https://cve.now/CVE-2025-26640.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-26642](https://cve.now/CVE-2025-26642.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +3)
- [CVE-2025-26637](https://cve.now/CVE-2025-26637.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-26635](https://cve.now/CVE-2025-26635.md): Windows Hello Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-26639](https://cve.now/CVE-2025-26639.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26628](https://cve.now/CVE-2025-26628.md): Azure Local Cluster Information Disclosure Vulnerability (CVSS 7.3, Microsoft Azure Local Cluster)
- [CVE-2025-25002](https://cve.now/CVE-2025-25002.md): Azure Local Cluster Information Disclosure Vulnerability (CVSS 6.8, Microsoft Azure Local Cluster)
- [CVE-2025-24058](https://cve.now/CVE-2025-24058.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21222](https://cve.now/CVE-2025-21222.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21221](https://cve.now/CVE-2025-21221.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21204](https://cve.now/CVE-2025-21204.md): Windows Process Activation Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21203](https://cve.now/CVE-2025-21203.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-21205](https://cve.now/CVE-2025-21205.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-21191](https://cve.now/CVE-2025-21191.md): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-21197](https://cve.now/CVE-2025-21197.md): Windows NTFS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-21174](https://cve.now/CVE-2025-21174.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-24073](https://cve.now/CVE-2025-24073.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24074](https://cve.now/CVE-2025-24074.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-29824](https://cve.now/CVE-2025-29824.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-29823](https://cve.now/CVE-2025-29823.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise)
- [CVE-2025-29822](https://cve.now/CVE-2025-29822.md): Microsoft OneNote Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-29820](https://cve.now/CVE-2025-29820.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-29821](https://cve.now/CVE-2025-29821.md): Microsoft Dynamics Business Central Information Disclosure Vulnerability (CVSS 5.5, Microsoft Dynamics 365 Business Central 2023 Wave · Micr… +2)
- [CVE-2025-29794](https://cve.now/CVE-2025-29794.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-29792](https://cve.now/CVE-2025-29792.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-29793](https://cve.now/CVE-2025-29793.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-29791](https://cve.now/CVE-2025-29791.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-27750](https://cve.now/CVE-2025-27750.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-27752](https://cve.now/CVE-2025-27752.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-27751](https://cve.now/CVE-2025-27751.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-27743](https://cve.now/CVE-2025-27743.md): Microsoft System Center Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft System Center Data Protection Manager · Micros… +3)
- [CVE-2025-27749](https://cve.now/CVE-2025-27749.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-27747](https://cve.now/CVE-2025-27747.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-27748](https://cve.now/CVE-2025-27748.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-27746](https://cve.now/CVE-2025-27746.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-27745](https://cve.now/CVE-2025-27745.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-27742](https://cve.now/CVE-2025-27742.md): NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-27744](https://cve.now/CVE-2025-27744.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office)
- [CVE-2025-27741](https://cve.now/CVE-2025-27741.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27740](https://cve.now/CVE-2025-27740.md): Active Directory Certificate Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-27479](https://cve.now/CVE-2025-27479.md): Kerberos Key Distribution Proxy Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2025-27478](https://cve.now/CVE-2025-27478.md): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-27477](https://cve.now/CVE-2025-27477.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-27475](https://cve.now/CVE-2025-27475.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-27476](https://cve.now/CVE-2025-27476.md): Windows Digital Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-27474](https://cve.now/CVE-2025-27474.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-27472](https://cve.now/CVE-2025-27472.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 5.4, Microsoft Windows)
- [CVE-2025-27473](https://cve.now/CVE-2025-27473.md): HTTP.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-27470](https://cve.now/CVE-2025-27470.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-27471](https://cve.now/CVE-2025-27471.md): Microsoft Streaming Service Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2025-26688](https://cve.now/CVE-2025-26688.md): Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26687](https://cve.now/CVE-2025-26687.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Office for Android · Microsoft Office for Univ… +1)
- [CVE-2025-26686](https://cve.now/CVE-2025-26686.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-26680](https://cve.now/CVE-2025-26680.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-26681](https://cve.now/CVE-2025-26681.md): Win32k Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-26668](https://cve.now/CVE-2025-26668.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-26667](https://cve.now/CVE-2025-26667.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-26669](https://cve.now/CVE-2025-26669.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-26666](https://cve.now/CVE-2025-26666.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-26665](https://cve.now/CVE-2025-26665.md): Windows upnphost.dll Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-26664](https://cve.now/CVE-2025-26664.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-26663](https://cve.now/CVE-2025-26663.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2025-32279](https://cve.now/CVE-2025-32279.md): WordPress Live Forms plugin \<= 4.8.5 - Broken Access Control vulnerability (CVSS 4.3, Shahjada Live Forms)
- [CVE-2025-32211](https://cve.now/CVE-2025-32211.md): WordPress Broadstreet plugin \<= 1.52.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Broadstreet Ads)
- [CVE-2025-32164](https://cve.now/CVE-2025-32164.md): WordPress m1.DownloadList plugin \<= 0.24 - Sensitive Data Exposure vulnerability (CVSS 6.5, maennchen1.de m1.DownloadList)
- [CVE-2025-32117](https://cve.now/CVE-2025-32117.md): WordPress Widgetize Pages Light plugin \<= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, OTWthemes Widgetize Pages Light)
- [CVE-2024-52981](https://cve.now/CVE-2024-52981.md): An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection o (CVSS 4.9, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-48887](https://cve.now/CVE-2024-48887.md): A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin password (CVSS 9.3, Fortinet FortiSwitch)
- [CVE-2024-52974](https://cve.now/CVE-2024-52974.md): An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. (CVSS 6.5, Elastic Kibana)
- [CVE-2024-52980](https://cve.now/CVE-2024-52980.md): Elasticsearch Uncontrolled Resource Consumption vulnerability (CVSS 6.5, Elasticsearch · org.elasticsearch:elasticsearch-grok)
- [CVE-2025-27084](https://cve.now/CVE-2025-27084.md): Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal (CP) of an AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-based Management Interface (CVSS 5.4, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS)
- [CVE-2025-27085](https://cve.now/CVE-2025-27085.md): Arbitrary File Download Vulnerabilities in Web-Based Management Interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor (CVSS 4.9, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS)
- [CVE-2025-27083](https://cve.now/CVE-2025-27083.md): Authenticated Command Injection Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS)
- [CVE-2025-25226](https://cve.now/CVE-2025-25226.md): \[20250401\] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package (CVSS 9.8, Joomla! Project Joomla! Framework · joomla/database)
- [CVE-2025-25227](https://cve.now/CVE-2025-25227.md): \[20250402\] - Joomla Core - MFA Authentication Bypass (CVSS 7.5, Joomla! Project Joomla! CMS · joomla/joomla-cms)
- [CVE-2025-27082](https://cve.now/CVE-2025-27082.md): Authenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS)
- [CVE-2025-30671](https://cve.now/CVE-2025-30671.md): Zoom Workplace Apps for Windows - Null Pointer (CVSS 6.5, Zoom Communications Zoom Workplace Apps for Windows)
- [CVE-2025-30670](https://cve.now/CVE-2025-30670.md): Zoom Workplace Apps for Windows - Null Pointer (CVSS 6.5, Zoom Communications Zoom Workplace Apps for Windows)
- [CVE-2025-27443](https://cve.now/CVE-2025-27443.md): Zoom Workplace Apps for Windows - Insecure Default Variable Initialization (CVSS 2.8, Zoom Communications Zoom Workplace Apps for Windows)
- [CVE-2025-27442](https://cve.now/CVE-2025-27442.md): Zoom Workplace Apps - Cross Site Scripting (CVSS 4.6, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-27441](https://cve.now/CVE-2025-27441.md): Zoom Workplace Apps - Cross Site Scripting (CVSS 4.6, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-32028](https://cve.now/CVE-2025-32028.md): HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution (CVSS 10.0, haxtheweb issues)
- [CVE-2025-27079](https://cve.now/CVE-2025-27079.md): Arbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI Interface (CVSS 6.0, Hewlett Packard Enterprise (HPE) AOS-10 AP)
- [CVE-2025-27078](https://cve.now/CVE-2025-27078.md): Authenticated Remote Command Execution caused by Insecure Function Usage in System Binary (CVSS 6.5, Hewlett Packard Enterprise (HPE) AOS-10 AP)
- [CVE-2025-32018](https://cve.now/CVE-2025-32018.md): Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docs (CVSS 8.1, getcursor cursor)
- [CVE-2025-32017](https://cve.now/CVE-2025-32017.md): Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users (CVSS 8.8, Umbraco-CMS · Umbraco.Cms)
- [CVE-2025-3289](https://cve.now/CVE-2025-3289.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-3288](https://cve.now/CVE-2025-3288.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-3287](https://cve.now/CVE-2025-3287.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-3286](https://cve.now/CVE-2025-3286.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-3285](https://cve.now/CVE-2025-3285.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-2829](https://cve.now/CVE-2025-2829.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-32026](https://cve.now/CVE-2025-32026.md): Element Web could load a malicious instance of Element Call leaking media encryption keys (CVSS 3.8, element-hq element-web)
- [CVE-2025-2293](https://cve.now/CVE-2025-2293.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-2288](https://cve.now/CVE-2025-2288.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-2287](https://cve.now/CVE-2025-2287.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-2286](https://cve.now/CVE-2025-2286.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-2285](https://cve.now/CVE-2025-2285.md): Local Code Execution Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2025-32025](https://cve.now/CVE-2025-32025.md): bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing (CVSS 6.9, bep imagemeta · github.com/bep/imagemeta)
- [CVE-2025-1095](https://cve.now/CVE-2025-1095.md): IBM Personal Communications command execution (CVSS 8.8, IBM Personal Communications)
- [CVE-2025-32024](https://cve.now/CVE-2025-32024.md): bep/imagemeta allows excessively large EXIF data structures (CVSS 6.9, bep imagemeta · github.com/bep/imagemeta)
- [CVE-2025-32020](https://cve.now/CVE-2025-32020.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser (CVSS 9.3, Guichaguri crud-query-parser · crud-query-parser)
- [CVE-2025-22466](https://cve.now/CVE-2025-22466.md): Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obta (CVSS 8.2, Ivanti Endpoint Manager)
- [CVE-2025-22465](https://cve.now/CVE-2025-22465.md): Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to exec (CVSS 6.1, Ivanti Endpoint Manager)
- [CVE-2025-22464](https://cve.now/CVE-2025-22464.md): An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attac (CVSS 6.1, Ivanti Endpoint Manager)
- [CVE-2025-22461](https://cve.now/CVE-2025-22461.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admi (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2025-22459](https://cve.now/CVE-2025-22459.md): Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticate (CVSS 4.8, Ivanti Endpoint Manager)
- [CVE-2025-22458](https://cve.now/CVE-2025-22458.md): DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-50565](https://cve.now/CVE-2024-50565.md): A improper restriction of communication channel to intended endpoints vulnerability \[CWE-923\] in Fortinet FortiOS version 7.4.0 through 7.4. (CVSS 3.0, Fortinet FortiOS · Fortinet FortiVoice +2)
- [CVE-2024-26013](https://cve.now/CVE-2024-26013.md): A improper restriction of communication channel to intended endpoints vulnerability \[CWE-923\] in Fortinet FortiOS version 7.4.0 through 7.4. (CVSS 7.1, Fortinet FortiProxy · Fortinet FortiManager +1)
- [CVE-2023-37930](https://cve.now/CVE-2023-37930.md): Multiple issues including the use of uninitialized ressources \[CWE-908\] and excessive iteration \[CWE-834\] vulnerabilities vulnerability in F (CVSS 6.7, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2024-52962](https://cve.now/CVE-2024-52962.md): An Improper Output Neutralization for Logs vulnerability \[CWE-117\] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, versio (CVSS 5.0, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-46671](https://cve.now/CVE-2024-46671.md): An Incorrect User Management vulnerability \[CWE-286\] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, (CVSS 5.6, Fortinet FortiWeb)
- [CVE-2024-32122](https://cve.now/CVE-2024-32122.md): A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, For (CVSS 2.1, Fortinet FortiOS)
- [CVE-2024-54024](https://cve.now/CVE-2024-54024.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] in Fortinet FortiIsolat (CVSS 7.0, Fortinet FortiIsolator)
- [CVE-2024-54025](https://cve.now/CVE-2024-54025.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] in Fortinet FortiIsolat (CVSS 6.5, Fortinet FortiIsolator)
- [CVE-2025-25254](https://cve.now/CVE-2025-25254.md): An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability \[CWE-22\] in FortiWeb version 7.6.2 and below (CVSS 6.8, Fortinet FortiWeb)
- [CVE-2025-22855](https://cve.now/CVE-2025-22855.md): An improper neutralization of input during web page generation ('Cross-site Scripting') \[CWE-79\] vulnerability in Fortinet FortiClient befor (CVSS 2.6, Fortinet FortiClientEMS)
- [CVE-2025-31498](https://cve.now/CVE-2025-31498.md): c-ares has a use-after-free in read\_answers() (CVSS 8.3, c-ares)
- [CVE-2025-30150](https://cve.now/CVE-2025-30150.md): Shopware 6 allows attackers to check for registered accounts through the store-api (CVSS 5.5, shopware · shopware/core +1)
- [CVE-2025-30151](https://cve.now/CVE-2025-30151.md): Shopware allows Denial Of Service via password length (CVSS 7.5, shopware · shopware/core +1)
- [CVE-2025-2876](https://cve.now/CVE-2025-2876.md): MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion (CVSS 5.3, MelaPress Login Security Premium · MelaPress Login Security)
- [CVE-2025-2568](https://cve.now/CVE-2025-2568.md): Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update (CVSS 5.3, themehunk Vayu Blocks – Gutenberg Blocks for WordPress & Wo…)
- [CVE-2025-30166](https://cve.now/CVE-2025-30166.md): Pimcore's Admin Classic Bundle allows HTML Injection (CVSS 1.8, pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…)
- [CVE-2025-29985](https://cve.now/CVE-2025-29985.md): Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the (CVSS 6.5, Dell Common Event Enabler)
- [CVE-2025-29986](https://cve.now/CVE-2025-29986.md): Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulnera (CVSS 8.3, Dell Common Event Enabler)
- [CVE-2025-2883](https://cve.now/CVE-2025-2883.md): Accept SagePay Payments Using Contact Form 7 \<= 2.0 - Unauthenticated Information Exposure (CVSS 5.3, zealopensource Accept SagePay Payments Using Contact Form)
- [CVE-2025-3437](https://cve.now/CVE-2025-3437.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up (CVSS 4.3, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-2808](https://cve.now/CVE-2025-2808.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-2807](https://cve.now/CVE-2025-2807.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-30280](https://cve.now/CVE-2025-30280.md): A vulnerability has been identified in Mendix Runtime V10 (All versions \< V10.21.0), Mendix Runtime V10.12 (All versions \< V10.12.16), Mendi (CVSS 5.3, Siemens Mendix Runtime)
- [CVE-2025-30000](https://cve.now/CVE-2025-30000.md): A vulnerability has been identified in Siemens License Server (SLS) (All versions \< V4.3). (CVSS 6.7, Siemens License Server)
- [CVE-2025-29999](https://cve.now/CVE-2025-29999.md): A vulnerability has been identified in Siemens License Server (SLS) (All versions \< V4.3). (CVSS 6.7, Siemens License Server)
- [CVE-2024-54092](https://cve.now/CVE-2024-54092.md): A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (Al (CVSS 9.8, Siemens Industrial Edge Device Kit - arm64 · Siemens Ind… +9)
- [CVE-2024-41796](https://cve.now/CVE-2024-41796.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 6.5, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2024-41795](https://cve.now/CVE-2024-41795.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 6.5, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2024-41794](https://cve.now/CVE-2024-41794.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 10.0, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2024-41793](https://cve.now/CVE-2024-41793.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 8.6, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2025-3064](https://cve.now/CVE-2025-3064.md): WPFront User Role Editor \<= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist\_options Function (CVSS 8.8, syammohanm WPFront User Role Editor)
- [CVE-2025-3436](https://cve.now/CVE-2025-3436.md): coreActivity: Activity Logging for WordPress \<= 2.7 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, gdragon coreActivity: Activity Logging for WordPress)
- [CVE-2025-3433](https://cve.now/CVE-2025-3433.md): Advanced Advertising System \<= 1.3.1 - Open Redirect (CVSS 6.1, smartdevth Advanced Advertising System)
- [CVE-2024-41792](https://cve.now/CVE-2024-41792.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 8.6, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2025-3432](https://cve.now/CVE-2025-3432.md): AAWEP Obfuscator \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, elpix AAWP Obfuscator)
- [CVE-2024-41791](https://cve.now/CVE-2024-41791.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 7.3, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2024-41790](https://cve.now/CVE-2024-41790.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 9.1, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2024-41789](https://cve.now/CVE-2024-41789.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 9.1, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2024-41788](https://cve.now/CVE-2024-41788.md): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). (CVSS 9.1, Siemens SENTRON 7KT PAC1260 Data Manager)
- [CVE-2025-22017](https://cve.now/CVE-2025-22017.md): devlink: fix xa\_alloc\_cyclic() error handling (no CVSS, Linux)
- [CVE-2025-22016](https://cve.now/CVE-2025-22016.md): dpll: fix xa\_alloc\_cyclic() error handling (no CVSS, Linux)
- [CVE-2025-22015](https://cve.now/CVE-2025-22015.md): mm/migrate: fix shmem xarray update during migration (CVSS 7.8, Linux)
- [CVE-2025-22014](https://cve.now/CVE-2025-22014.md): soc: qcom: pdr: Fix the potential deadlock (no CVSS, Linux)
- [CVE-2025-22013](https://cve.now/CVE-2025-22013.md): KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (CVSS 7.3, Linux)
- [CVE-2025-22012](https://cve.now/CVE-2025-22012.md): Revert "arm64: dts: qcom: sdm845: Affirm IDR0.CCTW on apps\_smmu" (CVSS 8.8, Linux)
- [CVE-2025-22011](https://cve.now/CVE-2025-22011.md): ARM: dts: bcm2711: Fix xHCI power-domain (CVSS 5.5, Linux)
- [CVE-2025-22010](https://cve.now/CVE-2025-22010.md): RDMA/hns: Fix soft lockup during bt pages loop (no CVSS, Linux)
- [CVE-2025-22009](https://cve.now/CVE-2025-22009.md): regulator: dummy: force synchronous probing (CVSS 5.5, Linux)
- [CVE-2025-22008](https://cve.now/CVE-2025-22008.md): regulator: check that dummy regulator has been probed before using it (no CVSS, Linux)
- [CVE-2025-2882](https://cve.now/CVE-2025-2882.md): GreenPay(tm) by Green.Money 3.0.0 - 3.0.9 - Unauthenticated Information Exposure (CVSS 5.3, greenmoney GreenPay(tm) by Green.Money)
- [CVE-2025-3431](https://cve.now/CVE-2025-3431.md): ZoomSounds - WordPress Wave Audio Player with Playlist \<= 6.91 - Unauthenticated Arbitrary File Download (CVSS 7.5, ZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…)
- [CVE-2025-31333](https://cve.now/CVE-2025-31333.md): Odata meta-data tampering in SAP S4CORE entity (CVSS 4.3, SAP\_SE SAP S4CORE entity)
- [CVE-2025-31332](https://cve.now/CVE-2025-31332.md): Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 6.6, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2025-31331](https://cve.now/CVE-2025-31331.md): Authorization Bypass vulnerability in SAP NetWeaver (CVSS 4.3, SAP\_SE SAP NetWeaver)
- [CVE-2025-31330](https://cve.now/CVE-2025-31330.md): Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) (CVSS 9.9, SAP\_SE SAP Landscape Transformation)
- [CVE-2025-30017](https://cve.now/CVE-2025-30017.md): Missing Authorization check in SAP Solution Manager (CVSS 4.4, SAP\_SE SAP Solution Manager)
- [CVE-2025-30016](https://cve.now/CVE-2025-30016.md): Authentication Bypass Vulnerability in SAP Financial Consolidation (CVSS 9.8, SAP\_SE SAP Financial Consolidation)
- [CVE-2025-30015](https://cve.now/CVE-2025-30015.md): Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) (CVSS 4.1, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2025-30014](https://cve.now/CVE-2025-30014.md): Directory Traversal vulnerability in SAP Capital Yield Tax Management (CVSS 7.7, SAP\_SE SAP Capital Yield Tax Management)
- [CVE-2025-30013](https://cve.now/CVE-2025-30013.md): Code Injection vulnerability in SAP ERP BW Business Content (CVSS 6.7, SAP\_SE SAP ERP BW Business Content)
- [CVE-2025-27437](https://cve.now/CVE-2025-27437.md): Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-27435](https://cve.now/CVE-2025-27435.md): Information Disclosure Vulnerability in SAP Commerce Cloud (CVSS 4.2, SAP\_SE SAP Commerce Cloud)
- [CVE-2025-27429](https://cve.now/CVE-2025-27429.md): Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) (CVSS 9.9, SAP\_SE SAP S/4HANA)
- [CVE-2025-27428](https://cve.now/CVE-2025-27428.md): Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) (CVSS 7.7, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2025-26657](https://cve.now/CVE-2025-26657.md): Information Disclosure vulnerability in SAP KMC WPC (CVSS 5.3, SAP\_SE SAP KMC WPC)
- [CVE-2025-26654](https://cve.now/CVE-2025-26654.md): Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) (CVSS 6.8, SAP\_SE SAP Commerce Cloud)
- [CVE-2025-26653](https://cve.now/CVE-2025-26653.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) (CVSS 4.7, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-23186](https://cve.now/CVE-2025-23186.md): Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP (CVSS 8.5, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-3428](https://cve.now/CVE-2025-3428.md): 3DPrint Lite \<=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating\_text' (CVSS 4.9, fuzzoid 3DPrint Lite)
- [CVE-2019-25223](https://cve.now/CVE-2019-25223.md): Team Circle Image Slider With Lightbox \<= 1.0.4 - Authenticated (Admin+) SQL Injection (CVSS 4.9, nik00726 Team Circle Image Slider With Lightbox)
- [CVE-2025-3430](https://cve.now/CVE-2025-3430.md): 3DPrint Lite \<=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'printer\_text' (CVSS 4.9, fuzzoid 3DPrint Lite)
- [CVE-2025-3429](https://cve.now/CVE-2025-3429.md): 3DPrint Lite \<=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material\_text' (CVSS 4.9, fuzzoid 3DPrint Lite)
- [CVE-2025-3427](https://cve.now/CVE-2025-3427.md): 3DPrint Lite \<=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill\_text' (CVSS 4.9, fuzzoid 3DPrint Lite)
- [CVE-2025-3413](https://cve.now/CVE-2025-3413.md): opplus springboot-admin SysGeneratorController.java code deserialization (CVSS 5.3, opplus springboot-admin)
- [CVE-2025-0361](https://cve.now/CVE-2025-0361.md): During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration fr (CVSS 4.3, Axis Communications AB AXIS OS)
- [CVE-2024-47261](https://cve.now/CVE-2024-47261.md): 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input valid (CVSS 4.3, Axis Communications AB AXIS OS)
- [CVE-2025-3412](https://cve.now/CVE-2025-3412.md): mymagicpower AIAS InferController.java server-side request forgery (CVSS 5.3, mymagicpower AIAS)
- [CVE-2025-3411](https://cve.now/CVE-2025-3411.md): mymagicpower AIAS AsrController.java server-side request forgery (CVSS 5.3, mymagicpower AIAS)
- [CVE-2025-3410](https://cve.now/CVE-2025-3410.md): mymagicpower AIAS LocalStorageController.java unrestricted upload (CVSS 5.3, mymagicpower AIAS)
- [CVE-2025-20946](https://cve.now/CVE-2025-20946.md): Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prior to SMR Apr-2025 Re (CVSS 8.8, Samsung Mobile Devices)
- [CVE-2025-20939](https://cve.now/CVE-2025-20939.md): Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update dev (CVSS 5.4, Samsung Mobile Devices)
- [CVE-2025-20951](https://cve.now/CVE-2025-20951.md): Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to writ (CVSS 5.1, Samsung Mobile Galaxy Store)
- [CVE-2025-20950](https://cve.now/CVE-2025-20950.md): Use of implicit intent for sensitive communication in SamsungNotes prior to version 4.4.26.45 allows local attackers to access sensitive inf (CVSS 4.0, Samsung Mobile SamsungNotes)
- [CVE-2025-20948](https://cve.now/CVE-2025-20948.md): Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read ou (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20947](https://cve.now/CVE-2025-20947.md): Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to acc (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20945](https://cve.now/CVE-2025-20945.md): Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy wat (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20944](https://cve.now/CVE-2025-20944.md): Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-20943](https://cve.now/CVE-2025-20943.md): Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2025-20942](https://cve.now/CVE-2025-20942.md): Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAI (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2025-20941](https://cve.now/CVE-2025-20941.md): Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-20940](https://cve.now/CVE-2025-20940.md): Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20938](https://cve.now/CVE-2025-20938.md): Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContact (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20936](https://cve.now/CVE-2025-20936.md): Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privi (CVSS 8.8, Samsung Mobile Devices)
- [CVE-2025-20935](https://cve.now/CVE-2025-20935.md): Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to acc (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20934](https://cve.now/CVE-2025-20934.md): Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-3409](https://cve.now/CVE-2025-3409.md): Nothings stb stb\_include\_string stack-based overflow (CVSS 5.3, Nothings stb)
- [CVE-2025-2004](https://cve.now/CVE-2025-2004.md): Simple WP Events \<= 1.8.17 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, wpminds Simple WP Events)
- [CVE-2024-13820](https://cve.now/CVE-2024-13820.md): Melhor Envio \<= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash (CVSS 5.3, melhorenvio Melhor Envio)
- [CVE-2025-3408](https://cve.now/CVE-2025-3408.md): Nothings stb stb\_dupreplace integer overflow (CVSS 5.3, Nothings stb)
- [CVE-2025-3407](https://cve.now/CVE-2025-3407.md): Nothings stb stbhw\_build\_tileset\_from\_image out-of-bounds (CVSS 5.3, Nothings stb)
- [CVE-2025-3406](https://cve.now/CVE-2025-3406.md): Nothings stb Header Array stbhw\_build\_tileset\_from\_image out-of-bounds (CVSS 5.3, Nothings stb)
- [CVE-2025-3405](https://cve.now/CVE-2025-3405.md): FCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injection (CVSS 5.3, FCJ Venture Builder appclientefiel)
- [CVE-2025-3403](https://cve.now/CVE-2025-3403.md): Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source (CVSS 5.1, Vivotek NVR ND8422P · Vivotek NVR ND9525P +1)
- [CVE-2025-3402](https://cve.now/CVE-2025-3402.md): Seeyon Zhiyuan Interconnect FE Collaborative Office Platform check.js%70 sql injection (CVSS 5.3, Seeyon Zhiyuan Interconnect FE Collaborative Office Platform)
- [CVE-2025-3401](https://cve.now/CVE-2025-3401.md): ESAFENET CDG getLimitIPList.jsp sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2025-3364](https://cve.now/CVE-2025-3364.md): HGiga PowerStation - Chroot Escape (CVSS 6.7, HGiga PowerStation)
- [CVE-2025-3363](https://cve.now/CVE-2025-3363.md): HGiga iSherlock - OS Command Injection (CVSS 9.8, HGiga iSherlock)
- [CVE-2025-3362](https://cve.now/CVE-2025-3362.md): HGiga iSherlock - OS Command Injection (CVSS 9.8, HGiga iSherlock)
- [CVE-2025-3400](https://cve.now/CVE-2025-3400.md): ESAFENET CDG UnChkMailApplication.jsp sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2025-3399](https://cve.now/CVE-2025-3399.md): ESAFENET CDG updateNotice.jsp sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2025-3361](https://cve.now/CVE-2025-3361.md): HGiga iSherlock - OS Command Injection (CVSS 9.8, HGiga iSherlock)
- [CVE-2025-2519](https://cve.now/CVE-2025-2519.md): Streamit \<= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download (CVSS 6.5, iqonicdesign Streamit)
- [CVE-2025-2525](https://cve.now/CVE-2025-2525.md): Streamit \<= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, iqonicdesign Streamit)
- [CVE-2025-2526](https://cve.now/CVE-2025-2526.md): Streamit \<= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover (CVSS 8.8, iqonicdesign Streamit)
- [CVE-2025-3398](https://cve.now/CVE-2025-3398.md): lenve VBlog WebSecurityConfig.java configure access control (CVSS 5.3, lenve VBlog)
- [CVE-2025-3397](https://cve.now/CVE-2025-3397.md): YzmCMS message.tpl cross site scripting (CVSS 5.3, YzmCMS)
- [CVE-2025-3393](https://cve.now/CVE-2025-3393.md): mrcen springboot-ucan-admin Personal Settings Interface index cross site scripting (CVSS 5.1, mrcen springboot-ucan-admin)
- [CVE-2025-3392](https://cve.now/CVE-2025-3392.md): hailey888 oa\_system Backend MailController.java save cross site scripting (CVSS 5.1, hailey888 oa\_system)
- [CVE-2025-3391](https://cve.now/CVE-2025-3391.md): hailey888 oa\_system Backend AddrController. java outAddress cross site scripting (CVSS 5.1, hailey888 oa\_system)
- [CVE-2025-3390](https://cve.now/CVE-2025-3390.md): hailey888 oa\_system Backend DaymanageController.java addandchangeday cross site scripting (CVSS 5.1, hailey888 oa\_system)
- [CVE-2024-55354](https://cve.now/CVE-2024-55354.md): Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism fai (CVSS 8.8, Lucee Server)
- [CVE-2025-32406](https://cve.now/CVE-2025-32406.md): An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch (CVSS 8.6, NAKIVO Backup & Replication Director)
- [CVE-2025-32413](https://cve.now/CVE-2025-32413.md): Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py. (CVSS 6.4, CIRCL Vulnerability-Lookup)
- [CVE-2025-32414](https://cve.now/CVE-2025-32414.md): In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an i (CVSS 5.6, xmlsoft libxml2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.