# CVEs published 2025-04-10

108 CVEs were published on April 10, 2025: 9 critical, 29 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-29918](https://cve.now/CVE-2025-29918.md): Suricata pcre: negated pcr can cause infinite loop (CVSS 6.2, OISF suricata)
- [CVE-2025-29917](https://cve.now/CVE-2025-29917.md): Suricata decode\_base64: signature can do large memory allocation (CVSS 6.2, OISF suricata)
- [CVE-2025-29916](https://cve.now/CVE-2025-29916.md): Suricata datasets: ruleset declared settings can lead to resource starvation (CVSS 6.2, OISF suricata)
- [CVE-2025-29915](https://cve.now/CVE-2025-29915.md): Suricata af-packet: defrag option can lead to truncated packets affecting visibility (CVSS 7.5, OISF suricata)
- [CVE-2025-23010](https://cve.now/CVE-2025-23010.md): An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client whic (CVSS 7.2, SonicWall NetExtender)
- [CVE-2025-23009](https://cve.now/CVE-2025-23009.md): A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an ar (CVSS 7.2, SonicWall NetExtender)
- [CVE-2025-23008](https://cve.now/CVE-2025-23008.md): An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker (CVSS 7.2, SonicWall NetExtender)
- [CVE-2025-32700](https://cve.now/CVE-2025-32700.md): AbuseFilter log interfaces expose global private and hidden filters when central DB is not available (CVSS 2.3, Wikimedia Foundation MediaWiki)
- [CVE-2025-32699](https://cve.now/CVE-2025-32699.md): Potential javascript injection attack enabled by Unicode normalization in Action API (CVSS 2.1, Wikimedia Foundation MediaWiki · Wikimedia Foundation Parso…)
- [CVE-2025-32698](https://cve.now/CVE-2025-32698.md): LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions (CVSS 2.1, Wikimedia Foundation MediaWiki)
- [CVE-2025-32697](https://cve.now/CVE-2025-32697.md): Cascading protection is not preventing file reversions (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2025-32696](https://cve.now/CVE-2025-32696.md): "reupload-own" restriction can be bypassed by reverting file (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2025-3469](https://cve.now/CVE-2025-3469.md): i18n XSS vulnerability in HTMLMultiSelectField when sections are used (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2025-22232](https://cve.now/CVE-2025-22232.md): Spring Cloud Config Server May Not Use Vault Token Sent By Clients (CVSS 5.3, Spring Cloud Config)
- [CVE-2025-24866](https://cve.now/CVE-2025-24866.md): Unauthorized Access to User Activity Logs API by delegated granular administration roles (CVSS 2.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-32382](https://cve.now/CVE-2025-32382.md): Snowflake credentials logged by the Metabase backend (CVSS 1.8, metabase)
- [CVE-2025-32027](https://cve.now/CVE-2025-32027.md): Yii does not prevent XSS in scenarios where fallback error renderer is used (CVSS 6.1, yiisoft yii · yiisoft/yii)
- [CVE-2025-0362](https://cve.now/CVE-2025-0362.md): Improper Restriction of Rendered UI Layers or Frames in GitLab (CVSS 6.4, GitLab)
- [CVE-2025-2469](https://cve.now/CVE-2025-2469.md): Debug Messages Revealing Unnecessary Information in GitLab (CVSS 3.7, GitLab)
- [CVE-2023-43035](https://cve.now/CVE-2023-43035.md): IBM Sterling Control Center information disclosure (CVSS 4.0, IBM Sterling Control Center)
- [CVE-2025-32395](https://cve.now/CVE-2025-32395.md): Vite has an \`server.fs.deny\` bypass with an invalid \`request-target\` (CVSS 6.0, vitejs vite · vite)
- [CVE-2023-42007](https://cve.now/CVE-2023-42007.md): IBM Sterling Control Center cross-site scripting (CVSS 5.4, IBM Sterling Control Center)
- [CVE-2023-43037](https://cve.now/CVE-2023-43037.md): IBM Maximo Application Suite improper access control (CVSS 6.5, IBM Maximo Application Suite)
- [CVE-2025-32391](https://cve.now/CVE-2025-32391.md): HedgeDoc allows XSS possibility through malicious SVG uploads (CVSS 6.4, hedgedoc)
- [CVE-2025-32383](https://cve.now/CVE-2025-32383.md): MaxKB has a reverse shell vulnerability in function library (CVSS 4.3, 1Panel-dev MaxKB)
- [CVE-2024-11129](https://cve.now/CVE-2024-11129.md): Generation of Error Message Containing Sensitive Information in GitLab (CVSS 6.3, GitLab)
- [CVE-2025-30148](https://cve.now/CVE-2025-30148.md): Silverstripe Framework has a XSS vulnerability in HTML editor (CVSS 5.4, silverstripe-framework · silverstripe/framework)
- [CVE-2025-25197](https://cve.now/CVE-2025-25197.md): Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports (CVSS 5.4, silverstripe-elemental · dnadesign/silverstripe-elemental)
- [CVE-2025-1677](https://cve.now/CVE-2025-1677.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-2408](https://cve.now/CVE-2025-2408.md): Insufficient Granularity of Access Control in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-32755](https://cve.now/CVE-2025-32755.md): In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all co (CVSS 9.1, Jenkins Project Jenkins jenkins/ssh-slave Docker images)
- [CVE-2025-32754](https://cve.now/CVE-2025-32754.md): In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all (CVSS 9.1, Jenkins Project Jenkins jenkins/ssh-agent Docker images)
- [CVE-2025-1073](https://cve.now/CVE-2025-1073.md): Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware ont (CVSS 7.5, Panasonic IR Control Hub)
- [CVE-2025-22374](https://cve.now/CVE-2025-22374.md): SSRF in CyberAudit-Web videx-legacy-ssl (CVSS 6.0, Videx CyberAudit-Web)
- [CVE-2025-22375](https://cve.now/CVE-2025-22375.md): Authentication Bypass in CyberAudit-Web (CVSS 9.3, Videx CyberAudit-Web)
- [CVE-2025-27350](https://cve.now/CVE-2025-27350.md): WordPress Vice Versa plugin \<= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hugh Mungus Vice Versa)
- [CVE-2025-31411](https://cve.now/CVE-2025-31411.md): WordPress Linet ERP-Woocommerce Integration plugin \<= 3.5.12 - Arbitrary File Read/Deletion vulnerability (CVSS 5.9, aribhour Linet ERP-Woocommerce Integration)
- [CVE-2025-23386](https://cve.now/CVE-2025-23386.md): gerbera: Privilege escalation from user gerbera to root because of insecure %post script (CVSS 7.8, openSUSE Tumbleweed)
- [CVE-2025-22279](https://cve.now/CVE-2025-22279.md): WordPress JetCompareWishlist plugin \<= 1.5.9 - Local File Inclusion vulnerability (CVSS 7.5, Crocoblock JetCompareWishlist)
- [CVE-2025-27081](https://cve.now/CVE-2025-27081.md): HPE NonStop OSM Service Connection Suite, Denial of Service vulnerability (CVSS 6.8, Hewlett Packard Enterprise HPE NonStop OSM Service Connecti…)
- [CVE-2025-32282](https://cve.now/CVE-2025-32282.md): WordPress ShareThis Dashboard for Google Analytics plugin \<= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ShareThis Dashboard for Google Analytics)
- [CVE-2025-32275](https://cve.now/CVE-2025-32275.md): WordPress Survey Maker plugin \<= 5.1.6.3 - Bypass vulnerability (CVSS 4.3, Ays Pro Survey Maker)
- [CVE-2025-32260](https://cve.now/CVE-2025-32260.md): WordPress DethemeKit For Elementor plugin \<= 2.1.10 - Broken Access Control vulnerability (CVSS 5.3, DethemeKit For Elementor)
- [CVE-2025-32259](https://cve.now/CVE-2025-32259.md): WordPress WP ULike plugin \<= 4.7.9.1 - Content Spoofing Vulnerability (CVSS 5.3, Alimir WP ULike)
- [CVE-2025-32244](https://cve.now/CVE-2025-32244.md): WordPress SEO Help plugin \<= 6.7.9 - Broken Access Control vulnerability (CVSS 6.5, QuantumCloud SEO Help)
- [CVE-2025-32243](https://cve.now/CVE-2025-32243.md): WordPress Internal Link Optimiser plugin \<= 5.1.2 - Settings Change vulnerability (CVSS 6.5, Toast Plugins Internal Link Optimiser)
- [CVE-2025-32242](https://cve.now/CVE-2025-32242.md): WordPress Hive Support plugin \<= 1.2.5 - Broken Access Control vulnerability (CVSS 6.5, Hive Support)
- [CVE-2025-32240](https://cve.now/CVE-2025-32240.md): WordPress Site Notify plugin \<= 1.0 - Broken Access Control Vulnerability (CVSS 6.5, wpvsingh Site Notify)
- [CVE-2025-32236](https://cve.now/CVE-2025-32236.md): WordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin \<= 1.9 - Broken Access Control vulnerability (CVSS 4.3, Woocommerce Products Reorder Drag Drop Multiple Sort – Sort…)
- [CVE-2025-32230](https://cve.now/CVE-2025-32230.md): WordPress Tutor LMS plugin \<= 3.4.0 - HTML Injection vulnerability (CVSS 4.3, Themeum Tutor LMS)
- [CVE-2025-32228](https://cve.now/CVE-2025-32228.md): WordPress Ai Image Alt Text Generator for WP plugin \<= 1.1.9 - Sensitive Data Exposure vulnerability (CVSS 4.3, WP Messiah Ai Image Alt Text Generator for WP)
- [CVE-2025-32227](https://cve.now/CVE-2025-32227.md): WordPress Asgaros Forum plugin \<= 3.0.0 - File Upload Numbers Bypass vulnerability (CVSS 4.3, Asgaros Forum)
- [CVE-2025-32221](https://cve.now/CVE-2025-32221.md): WordPress EazyDocs plugin \<= 2.7.1 - Broken Access Control vulnerability (CVSS 5.4, Spider Themes EazyDocs)
- [CVE-2025-32216](https://cve.now/CVE-2025-32216.md): WordPress Spider Elements – Addons for Elementor plugin \<= 1.6.6 - Broken Access Control vulnerability (CVSS 6.4, Spider Themes Spider Elements)
- [CVE-2025-32215](https://cve.now/CVE-2025-32215.md): WordPress Accessibility Suite plugin \<= 4.18 - Arbitrary File Upload vulnerability (CVSS 6.5, Ability Accessibility Suite)
- [CVE-2025-32214](https://cve.now/CVE-2025-32214.md): WordPress Hive Support plugin \<= 1.2.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hive Support)
- [CVE-2025-32213](https://cve.now/CVE-2025-32213.md): WordPress Flo Forms plugin \<= 1.0.43 - Broken Access Control vulnerability (CVSS 6.5, flothemesplugins Flo Forms)
- [CVE-2025-32212](https://cve.now/CVE-2025-32212.md): WordPress Specia Companion plugin \<= 6.3 - Broken Access Control vulnerability (CVSS 6.5, Specia Theme Specia Companion)
- [CVE-2025-32210](https://cve.now/CVE-2025-32210.md): WordPress CM Registration and Invitation Codes plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 6.5, CreativeMindsSolutions CM Registration and Invitation Codes)
- [CVE-2025-32209](https://cve.now/CVE-2025-32209.md): WordPress Total processing card payments for WooCommerce Plugin \<= 7.1.5 - Arbitrary File Download vulnerability (CVSS 6.5, totalprocessing Nomupay Payment Processing Gateway)
- [CVE-2025-32208](https://cve.now/CVE-2025-32208.md): WordPress Hive Support plugin \<= 1.2.5 - Broken Access Control vulnerability (CVSS 6.5, Hive Support)
- [CVE-2025-32206](https://cve.now/CVE-2025-32206.md): WordPress Processing Projects Plugin \<= 1.0.2 - Arbitrary File Upload vulnerability (CVSS 9.1, LABCAT Processing Projects)
- [CVE-2025-32205](https://cve.now/CVE-2025-32205.md): WordPress Piotnet Forms plugin \<= 1.0.30 - Path Traversal vulnerability (CVSS 2.7, piotnetdotcom Piotnet Forms)
- [CVE-2025-32202](https://cve.now/CVE-2025-32202.md): WordPress Insert or Embed Articulate Content into WordPress plugin \<= 4.3000000025 - Arbitrary File Upload vulnerability (CVSS 9.1, Brian Batt - elearningfreak.com Insert or Embed Articulate…)
- [CVE-2025-32199](https://cve.now/CVE-2025-32199.md): WordPress Contact Form Builder by vcita plugin \<= 4.10.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, eyale-vc Contact Form Builder by vcita)
- [CVE-2025-32198](https://cve.now/CVE-2025-32198.md): WordPress Brizy plugin \<= 2.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themefusecom Brizy)
- [CVE-2025-32160](https://cve.now/CVE-2025-32160.md): WordPress EventON plugin \<= 2.4.1 - Local File Inclusion vulnerability (CVSS 7.5, Ashan Perera EventON)
- [CVE-2025-32158](https://cve.now/CVE-2025-32158.md): WordPress aThemes Addons for Elementor plugin \<= 1.1.3 - Local File Inclusion vulnerability (CVSS 7.5, Syed Balkhi aThemes Addons for Elementor)
- [CVE-2025-32145](https://cve.now/CVE-2025-32145.md): WordPress WpEvently plugin \<= 4.3.6 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam WpEvently)
- [CVE-2025-32140](https://cve.now/CVE-2025-32140.md): WordPress WP Remote Thumbnail Plugin \<= 1.3.2 - Arbitrary File Upload vulnerability (CVSS 9.9, Nirmal Kumar Ram WP Remote Thumbnail)
- [CVE-2025-32139](https://cve.now/CVE-2025-32139.md): WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin \<= 2.7.33 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, FooPlugins FooBox Image Lightbox)
- [CVE-2025-32128](https://cve.now/CVE-2025-32128.md): WordPress Nearby Locations Plugin \<= 1.1.1 - SQL Injection vulnerability (CVSS 7.6, aaronfrey Nearby Locations)
- [CVE-2025-32119](https://cve.now/CVE-2025-32119.md): WordPress CardGate Payments for WooCommerce plugin \<= 3.2.1 - SQL Injection vulnerability (CVSS 8.2, CardGate Payments for WooCommerce)
- [CVE-2025-32116](https://cve.now/CVE-2025-32116.md): WordPress QR Master plugin \<= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Studi7 QR Master)
- [CVE-2025-32115](https://cve.now/CVE-2025-32115.md): WordPress Popping Content Light plugin \<= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, OTWthemes Popping Content Light)
- [CVE-2025-32114](https://cve.now/CVE-2025-32114.md): WordPress 5sterrenspecialist plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress 5sterrenspecialist Plugin)
- [CVE-2025-31524](https://cve.now/CVE-2025-31524.md): WordPress WP User Profiles plugin \<= 2.6.2 - Privilege Escalation vulnerability (CVSS 8.8, John James Jacoby WP User Profiles)
- [CVE-2025-30582](https://cve.now/CVE-2025-30582.md): WordPress DyaPress ERP/CRM plugin \<= 18.0.2.0 - Local File Inclusion Vulnerability (CVSS 8.1, aytechnet DyaPress ERP/CRM)
- [CVE-2025-32687](https://cve.now/CVE-2025-32687.md): WordPress Review Stars Count For WooCommerce plugin \<= 2.0 - SQL Injection Vulnerability (CVSS 8.5, Magnigenie Review Stars Count For WooCommerce)
- [CVE-2025-32668](https://cve.now/CVE-2025-32668.md): WordPress Real Estate Manager plugin \<= 7.3 - Local File Inclusion vulnerability (CVSS 8.1, Rameez Iqbal Real Estate Manager)
- [CVE-2024-38865](https://cve.now/CVE-2024-38865.md): Livestatus command injection in RestAPI (CVSS 6.0, Checkmk)
- [CVE-2025-3417](https://cve.now/CVE-2025-3417.md): Embedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, stringfold Embedder)
- [CVE-2024-13909](https://cve.now/CVE-2024-13909.md): Accredible Certificates & Open Badges \<= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter (CVSS 4.9, Accredible Certificates & Open Badges)
- [CVE-2025-2805](https://cve.now/CVE-2025-2805.md): ORDER POST \<= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, vikashsrivastava1111989 ORDER POST)
- [CVE-2025-2719](https://cve.now/CVE-2025-2719.md): Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 6.5, hasthemes Swatchly – WooCommerce Variation Swatches for Pro…)
- [CVE-2025-2809](https://cve.now/CVE-2025-2809.md): azurecurve Shortcodes in Comments \<= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, azurecurve Shortcodes in Comments)
- [CVE-2024-10894](https://cve.now/CVE-2024-10894.md): Payment Forms for Paystack \<= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kendysond Payment Forms for Paystack)
- [CVE-2024-13896](https://cve.now/CVE-2024-13896.md): WP-GeSHi-Highlight \<= 1.4.3 - Author+ ReDoS (CVSS 6.5, WP-GeSHi-Highlight — rock-solid syntax highlighting for 259…)
- [CVE-2024-13874](https://cve.now/CVE-2024-13874.md): Feedify – Web Push Notifications \< 2.4.6 - Reflected XSS (CVSS 7.1, Feedify)
- [CVE-2025-0539](https://cve.now/CVE-2025-0539.md): In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentic (CVSS 5.9, Octopus Deploy Octopus Server)
- [CVE-2025-3102](https://cve.now/CVE-2025-3102.md): SureTriggers \<= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation (CVSS 8.1, brainstormforce OttoKit: All-in-One Automation Platform)
- [CVE-2025-3489](https://cve.now/CVE-2025-3489.md): Nababur Simple-User-Management-System register.php cross site scripting (CVSS 5.3, Nababur Simple-User-Management-System)
- [CVE-2025-26479](https://cve.now/CVE-2025-26479.md): Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write vulnerability. (CVSS 3.1, Dell PowerScale OneFS)
- [CVE-2025-23378](https://cve.now/CVE-2025-23378.md): Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an exposure of information through directory listing vulnerability. (CVSS 3.3, Dell PowerScale OneFS)
- [CVE-2025-26480](https://cve.now/CVE-2025-26480.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2025-22471](https://cve.now/CVE-2025-22471.md): Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an integer overflow or wraparound vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2025-26330](https://cve.now/CVE-2025-26330.md): Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. (CVSS 7.0, Dell PowerScale OneFS)
- [CVE-2025-27690](https://cve.now/CVE-2025-27690.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. (CVSS 9.8, Dell PowerScale OneFS)
- [CVE-2025-29989](https://cve.now/CVE-2025-29989.md): Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. (CVSS 3.1, Dell Client Platform BIOS)
- [CVE-2024-58136](https://cve.now/CVE-2024-58136.md): Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an \_\_class array key, a CVE-2024-4990 regression, as exploited i (CVSS 9.0, KEV, yiiframework Yii · yiisoft/yii2)
- [CVE-2025-27812](https://cve.now/CVE-2025-27812.md): MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation. (CVSS 8.1, MSI Center)
- [CVE-2025-27813](https://cve.now/CVE-2025-27813.md): MSI Center before 2.0.52.0 has Missing PE Signature Validation. (CVSS 8.1, MSI Center)
- [CVE-2025-29017](https://cve.now/CVE-2025-29017.md): A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the (CVSS 8.8)
- [CVE-2025-29088](https://cve.now/CVE-2025-29088.md): In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3\_db\_config (in the C-language API) can cause a denial of service (applicat (CVSS 5.6, SQLite)
- [CVE-2025-29150](https://cve.now/CVE-2025-29150.md): BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. (CVSS 4.3)
- [CVE-2025-32728](https://cve.now/CVE-2025-32728.md): In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent (CVSS 4.3, OpenBSD OpenSSH)
- [CVE-2025-32743](https://cve.now/CVE-2025-32743.md): In ConnMan through 1.44, the lookup string in ns\_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a (CVSS 9.0, ConnMan)
- [CVE-2025-32807](https://cve.now/CVE-2025-32807.md): A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (CVSS 5.3, FusionDirectory)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.