CVEs published April 10, 2025
108 CVEs were published on April 10, 2025: 9 critical, 29 high. 1 is now in CISA KEV.
- Published
- 108
- Critical
- 9
- High
- 29
- Medium
- 57
- Low
- 13
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 33
Most affected products
- Dell PowerScale OneFS
- 6
- GitLab
- 5
- Wikimedia Foundation MediaWiki
- 5
- OISF suricata
- 4
- Hive Support
- 3
- SonicWall NetExtender
- 3
- IBM Sterling Control Center
- 2
- MSI Center
- 2
- Videx CyberAudit-Web
- 2
- 1Panel-dev MaxKB
- 1
Critical 9
- CVE-2025-32755In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all coJenkins Project Jenkins jenkins/ssh-slave Docker images
- CVE-2025-32754In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing allJenkins Project Jenkins jenkins/ssh-agent Docker images
- CVE-2025-22375Authentication Bypass in CyberAudit-WebVidex CyberAudit-Web
- CVE-2025-32206WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerabilityLABCAT Processing Projects
- CVE-2025-32202WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000025 - Arbitrary File Upload vulnerabilityBrian Batt - elearningfreak.com Insert or Embed Articulate…
- CVE-2025-32140WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerabilityNirmal Kumar Ram WP Remote Thumbnail
- CVE-2025-27690Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability.Dell PowerScale OneFS
- CVE-2024-58136Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iyiiframework Yii · yiisoft/yii2
- CVE-2025-32743In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in aConnMan
High 29
- CVE-2025-29915Suricata af-packet: defrag option can lead to truncated packets affecting visibilityOISF suricata
- CVE-2025-23010An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client whicSonicWall NetExtender
- CVE-2025-23009A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arSonicWall NetExtender
- CVE-2025-23008An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker SonicWall NetExtender
- CVE-2025-1073Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware ontPanasonic IR Control Hub
- CVE-2025-27350WordPress Vice Versa plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityHugh Mungus Vice Versa
- CVE-2025-23386gerbera: Privilege escalation from user gerbera to root because of insecure %post scriptopenSUSE Tumbleweed
- CVE-2025-22279WordPress JetCompareWishlist plugin <= 1.5.9 - Local File Inclusion vulnerabilityCrocoblock JetCompareWishlist
- CVE-2025-32160WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerabilityAshan Perera EventON
- CVE-2025-32158WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerabilitySyed Balkhi aThemes Addons for Elementor
- CVE-2025-32145WordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerabilitymagepeopleteam WpEvently
- CVE-2025-32128WordPress Nearby Locations Plugin <= 1.1.1 - SQL Injection vulnerabilityaaronfrey Nearby Locations
- CVE-2025-32119WordPress CardGate Payments for WooCommerce plugin <= 3.2.1 - SQL Injection vulnerabilityCardGate Payments for WooCommerce
- CVE-2025-32116WordPress QR Master plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityStudi7 QR Master
- CVE-2025-32115WordPress Popping Content Light plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityOTWthemes Popping Content Light
- CVE-2025-32114WordPress 5sterrenspecialist plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress 5sterrenspecialist Plugin
- CVE-2025-31524WordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerabilityJohn James Jacoby WP User Profiles
- CVE-2025-30582WordPress DyaPress ERP/CRM plugin <= 18.0.2.0 - Local File Inclusion Vulnerabilityaytechnet DyaPress ERP/CRM
- CVE-2025-32687WordPress Review Stars Count For WooCommerce plugin <= 2.0 - SQL Injection VulnerabilityMagnigenie Review Stars Count For WooCommerce
- CVE-2025-32668WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerabilityRameez Iqbal Real Estate Manager
- CVE-2025-3417Embedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Updatestringfold Embedder
- CVE-2025-2805ORDER POST <= 2.0.2 - Unauthenticated Arbitrary Shortcode Executionvikashsrivastava1111989 ORDER POST
- CVE-2025-2809azurecurve Shortcodes in Comments <= 2.0.2 - Unauthenticated Arbitrary Shortcode Executionazurecurve Shortcodes in Comments
- CVE-2024-13874Feedify – Web Push Notifications < 2.4.6 - Reflected XSSFeedify
- CVE-2025-3102SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creationbrainstormforce OttoKit: All-in-One Automation Platform
- CVE-2025-26330Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability.Dell PowerScale OneFS
- CVE-2025-27812MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation.MSI Center
- CVE-2025-27813MSI Center before 2.0.52.0 has Missing PE Signature Validation.MSI Center
- CVE-2025-29017A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the
Medium, low and unrated 70
- CVE-2025-29918Suricata pcre: negated pcr can cause infinite loopOISF suricata
- CVE-2025-29917Suricata decode_base64: signature can do large memory allocationOISF suricata
- CVE-2025-29916Suricata datasets: ruleset declared settings can lead to resource starvationOISF suricata
- CVE-2025-32700AbuseFilter log interfaces expose global private and hidden filters when central DB is not availableWikimedia Foundation MediaWiki
- CVE-2025-32699Potential javascript injection attack enabled by Unicode normalization in Action APIWikimedia Foundation MediaWiki · Wikimedia Foundation Parso…
- CVE-2025-32698LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionsWikimedia Foundation MediaWiki
- CVE-2025-32697Cascading protection is not preventing file reversionsWikimedia Foundation MediaWiki
- CVE-2025-32696"reupload-own" restriction can be bypassed by reverting fileWikimedia Foundation MediaWiki
- CVE-2025-3469i18n XSS vulnerability in HTMLMultiSelectField when sections are usedWikimedia Foundation MediaWiki
- CVE-2025-22232Spring Cloud Config Server May Not Use Vault Token Sent By ClientsSpring Cloud Config
- CVE-2025-24866Unauthorized Access to User Activity Logs API by delegated granular administration rolesMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-32382Snowflake credentials logged by the Metabase backendmetabase
- CVE-2025-32027Yii does not prevent XSS in scenarios where fallback error renderer is usedyiisoft yii · yiisoft/yii
- CVE-2025-0362Improper Restriction of Rendered UI Layers or Frames in GitLabGitLab
- CVE-2025-2469Debug Messages Revealing Unnecessary Information in GitLabGitLab
- CVE-2023-43035IBM Sterling Control Center information disclosureIBM Sterling Control Center
- CVE-2025-32395Vite has an `server.fs.deny` bypass with an invalid `request-target`vitejs vite · vite
- CVE-2023-42007IBM Sterling Control Center cross-site scriptingIBM Sterling Control Center
- CVE-2023-43037IBM Maximo Application Suite improper access controlIBM Maximo Application Suite
- CVE-2025-32391HedgeDoc allows XSS possibility through malicious SVG uploadshedgedoc
- CVE-2025-32383MaxKB has a reverse shell vulnerability in function library1Panel-dev MaxKB
- CVE-2024-11129Generation of Error Message Containing Sensitive Information in GitLabGitLab
- CVE-2025-30148Silverstripe Framework has a XSS vulnerability in HTML editorsilverstripe-framework · silverstripe/framework
- CVE-2025-25197Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reportssilverstripe-elemental · dnadesign/silverstripe-elemental
- CVE-2025-1677Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-2408Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-22374SSRF in CyberAudit-Web videx-legacy-sslVidex CyberAudit-Web
- CVE-2025-31411WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.12 - Arbitrary File Read/Deletion vulnerabilityaribhour Linet ERP-Woocommerce Integration
- CVE-2025-27081HPE NonStop OSM Service Connection Suite, Denial of Service vulnerabilityHewlett Packard Enterprise HPE NonStop OSM Service Connecti…
- CVE-2025-32282WordPress ShareThis Dashboard for Google Analytics plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityShareThis Dashboard for Google Analytics
- CVE-2025-32275WordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerabilityAys Pro Survey Maker
- CVE-2025-32260WordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerabilityDethemeKit For Elementor
- CVE-2025-32259WordPress WP ULike plugin <= 4.7.9.1 - Content Spoofing VulnerabilityAlimir WP ULike
- CVE-2025-32244WordPress SEO Help plugin <= 6.7.9 - Broken Access Control vulnerabilityQuantumCloud SEO Help
- CVE-2025-32243WordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerabilityToast Plugins Internal Link Optimiser
- CVE-2025-32242WordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerabilityHive Support
- CVE-2025-32240WordPress Site Notify plugin <= 1.0 - Broken Access Control Vulnerabilitywpvsingh Site Notify
- CVE-2025-32236WordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin <= 1.9 - Broken Access Control vulnerabilityWoocommerce Products Reorder Drag Drop Multiple Sort – Sort…
- CVE-2025-32230WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerabilityThemeum Tutor LMS
- CVE-2025-32228WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Sensitive Data Exposure vulnerabilityWP Messiah Ai Image Alt Text Generator for WP
- CVE-2025-32227WordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerabilityAsgaros Forum
- CVE-2025-32221WordPress EazyDocs plugin <= 2.7.1 - Broken Access Control vulnerabilitySpider Themes EazyDocs
- CVE-2025-32216WordPress Spider Elements – Addons for Elementor plugin <= 1.6.6 - Broken Access Control vulnerabilitySpider Themes Spider Elements
- CVE-2025-32215WordPress Accessibility Suite plugin <= 4.18 - Arbitrary File Upload vulnerabilityAbility Accessibility Suite
- CVE-2025-32214WordPress Hive Support plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerabilityHive Support
- CVE-2025-32213WordPress Flo Forms plugin <= 1.0.43 - Broken Access Control vulnerabilityflothemesplugins Flo Forms
- CVE-2025-32212WordPress Specia Companion plugin <= 6.3 - Broken Access Control vulnerabilitySpecia Theme Specia Companion
- CVE-2025-32210WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerabilityCreativeMindsSolutions CM Registration and Invitation Codes
- CVE-2025-32209WordPress Total processing card payments for WooCommerce Plugin <= 7.1.5 - Arbitrary File Download vulnerabilitytotalprocessing Nomupay Payment Processing Gateway
- CVE-2025-32208WordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerabilityHive Support
- CVE-2025-32205WordPress Piotnet Forms plugin <= 1.0.30 - Path Traversal vulnerabilitypiotnetdotcom Piotnet Forms
- CVE-2025-32199WordPress Contact Form Builder by vcita plugin <= 4.10.2 - Cross Site Scripting (XSS) vulnerabilityeyale-vc Contact Form Builder by vcita
- CVE-2025-32198WordPress Brizy plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerabilitythemefusecom Brizy
- CVE-2025-32139WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.7.33 - Cross Site Scripting (XSS) vulnerabilityFooPlugins FooBox Image Lightbox
- CVE-2024-38865Livestatus command injection in RestAPICheckmk
- CVE-2024-13909Accredible Certificates & Open Badges <= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby ParameterAccredible Certificates & Open Badges
- CVE-2025-2719Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Updatehasthemes Swatchly – WooCommerce Variation Swatches for Pro…
- CVE-2024-10894Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingkendysond Payment Forms for Paystack
- CVE-2024-13896WP-GeSHi-Highlight <= 1.4.3 - Author+ ReDoSWP-GeSHi-Highlight — rock-solid syntax highlighting for 259…
- CVE-2025-0539In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authenticOctopus Deploy Octopus Server
- CVE-2025-3489Nababur Simple-User-Management-System register.php cross site scriptingNababur Simple-User-Management-System
- CVE-2025-26479Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write vulnerability.Dell PowerScale OneFS
- CVE-2025-23378Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an exposure of information through directory listing vulnerability.Dell PowerScale OneFS
- CVE-2025-26480Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability.Dell PowerScale OneFS
- CVE-2025-22471Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an integer overflow or wraparound vulnerability.Dell PowerScale OneFS
- CVE-2025-29989Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability.Dell Client Platform BIOS
- CVE-2025-29088In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (applicatSQLite
- CVE-2025-29150BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request.
- CVE-2025-32728In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent OpenBSD OpenSSH
- CVE-2025-32807A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png FusionDirectory