CVEs published April 15, 2025
262 CVEs were published on April 15, 2025: 20 critical, 62 high.
- Published
- 262
- Critical
- 20
- High
- 62
- Medium
- 171
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 83
Most affected products
- Growatt Cloud portal
- 30
- Oracle MySQL Server
- 23
- Chocobozzz/PeerTube
- 7
- Oracle Database Server
- 5
- Autodesk Revit · Autodesk AutoCAD +2
- 4
- Oracle MySQL Cluster · Oracle MySQL Server
- 4
- HCL Software HCL BigFix Platform
- 3
- Mozilla Thunderbird
- 3
- NotFound WPJobBoard
- 3
- Oracle Application Object Library
- 3
Critical 20
- CVE-2025-30215NATS-Server Fails to Authorize Certain Jetstream Admin APIsnats-io nats-server · github.com/nats-io/nats-server/v2
- CVE-2025-30967WordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerabilityNotFound WPJobBoard
- CVE-2025-26927WordPress AI Hub plugin <= 1.3.7 - Arbitrary File Upload vulnerabilityLiquidThemes AI Hub
- CVE-2025-24297Growatt Cloud portal Cross-site ScriptingGrowatt Cloud portal
- CVE-2025-30510Growatt Cloud portal Insufficient Type DistinctionGrowatt Cloud portal
- CVE-2025-30727Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module).Oracle Scripting
- CVE-2025-32778Web-Check allows command Injection via Unvalidated URL in Screenshot APILissy93 web-check
- CVE-2025-2567Lantronix Xport Missing Authentication for Critical FunctionLantronix Xport
- CVE-2025-32445Users can gain privileged access to the host system and cluster with EventSource and Sensor CRargoproj argo-events · github.com/argoproj/argo-events
- CVE-2025-30206Dpanel's hard-coded JWT secret leads to remote code executiondonknap dpanel · github.com/donknap/dpanel
- CVE-2025-32911Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable valuelibsoup · Red Hat Enterprise Linux 7 Extended Lifecycle… +1
- CVE-2025-30985WordPress GNUCommerce plugin <= 1.5.4 - PHP Object Injection vulnerabilitykagla GNUCommerce
- CVE-2025-3579Code Injection Vulnerability in AiDexAiDex
- CVE-2025-3578Adversarial Input Handling Vulnerability in AiDexAiDex
- CVE-2021-27289A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor =
- CVE-2025-22900Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function
- CVE-2025-25456Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2.
- CVE-2025-28100A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at t
- CVE-2025-28137The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg…
- CVE-2025-28399An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Control
High 62
- CVE-2025-32784conda-forge-webservices has an Unauthorized Artifact Modification Race Conditionconda-forge-webservices
- CVE-2025-32923WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerabilityGoodLayers Tourmaster
- CVE-2025-30984WordPress SEO Tools plugin <= 4.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityDzynit SEO Tools
- CVE-2025-30970WordPress Easy Contact plugin <= 0.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityscottwallick Easy Contact
- CVE-2025-27011WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-27008WordPress Unlimited Timeline < 1.6.1 - Broken Access Control VulnerabilityNotFound Unlimited Timeline
- CVE-2025-26953WordPress JetMenu plugin <= 2.4.9 - Broken Access Control VulnerabilityCrocoblock JetMenu
- CVE-2025-26908WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerabilityGurmehub Kargo Entegratör
- CVE-2025-26748WordPress Arkhe theme <= 3.12.0 - CSRF to Local File Inclusion vulnerabilitylooswebstudio Arkhe
- CVE-2025-26746WordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilitycaalami Advanced Custom Fields: Link Picker Field
- CVE-2025-26730WordPress Macro Calculator with Admin Email Optin & Data plugin <= 1.0 - Multiple Vulnerabilities vulnerabilityNotFound Macro Calculator with Admin Email Optin & Data
- CVE-2025-22263WordPress Global Gallery plugin <= 8.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityNotFound Global Gallery
- CVE-2025-1274RCS File Parsing Out-of-Bounds Write VulnerabilityAutodesk Revit · Autodesk AutoCAD +2
- CVE-2025-1277PDF File Parsing Memory Corruption VulnerabilityAutodesk Revit · Autodesk AutoCAD +2
- CVE-2025-1656PDF File Parsing Heap-based Overflow VulnerabilityAutodesk Revit · Autodesk AutoCAD +2
- CVE-2025-1273PDF File Parsing Heap-Based Overflow VulnerabilityAutodesk Revit · Autodesk AutoCAD +2
- CVE-2025-2497DWG File Parsing Stack-Based Buffer VulnerabilityAutodesk Revit
- CVE-2025-1276DWG File Parsing Out-of-Bounds Write VulnerabilityAutodesk AutoCAD · Autodesk Advance Steel +2
- CVE-2025-1275JPG File Parsing Heap-Based Overflow VulnerabilityAutodesk Revit · Autodesk AutoCAD +3
- CVE-2025-31499Jellyfin Vulnerable to Argument Injection in FFmpegjellyfin
- CVE-2025-30736Vulnerability in the Java VM component of Oracle Database Server.Oracle Database Server
- CVE-2025-30735Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field ConfiguratiOracle PeopleSoft Enterprise CC Common Application Objects
- CVE-2025-30730Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).Oracle Application Object Library
- CVE-2025-30728Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core).Oracle Configurator
- CVE-2025-30724Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services).Oracle BI Publisher
- CVE-2025-30716Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework).Oracle Common Applications
- CVE-2025-30712Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-30708Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search and Register Users).Oracle User Management
- CVE-2025-30707Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management).Oracle iStore
- CVE-2025-30706Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).Oracle MySQL Connectors
- CVE-2025-30701Vulnerability in the RAS Security component of Oracle Database Server.Oracle Database Server
- CVE-2025-30690Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).Oracle Solaris
- CVE-2025-30686Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: EMC).Oracle Hospitality Simphony
- CVE-2025-21587Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).Oracle Java SE · Oracle GraalVM for JDK +1
- CVE-2025-30511Growatt Cloud Applications Cross-site ScriptingGrowatt Cloud portal
- CVE-2025-31497TEIGarage XML External Entity (XXE) Injection in Document Conversion ServiceTEIC TEIGarage
- CVE-2025-32438Local privilege escalation in make-initrd-ngNixOS nixpkgs
- CVE-2025-27791Collabora Online Vulnerable to Arbitrary File WriteCollaboraOnline online
- CVE-2025-3618Local Privilege Escalation VulnerabilityRockwell Automation ThinManager
- CVE-2025-3617Local Privilege Escalation in ThinManager®Rockwell Automation ThinManager®
- CVE-2025-32780BleachBit for Windows Has DLL Untrusted Path Vulnerabilitybleachbit
- CVE-2025-32948PeerTube ActivityPub Playlist Creation Blind SSRF and DoSChocobozzz/PeerTube
- CVE-2025-32947PeerTube ActivityPub Crawl Infinite Loop DoSChocobozzz/PeerTube
- CVE-2025-31011WordPress SimplyRETS Real Estate IDX plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityReichertBrothers SimplyRETS Real Estate IDX
- CVE-2025-30962WordPress FS Poster plugin <= 6.5.8 - Reflected Cross Site Scripting (XSS) vulnerabilityfs-code FS Poster
- CVE-2025-26959WordPress Administrator Z <= 2025.03.24 - Privilege Escalation VulnerabilityQuý Lê 91 Administrator Z
- CVE-2025-26958WordPress JetBlog plugin <= 2.4.3 - Broken Access Control VulnerabilityCrocoblock JetBlog
- CVE-2025-26954WordPress ZooEffect plugin <= 1.11 - Reflected Cross Site Scripting (XSS) vulnerability1pluginjquery ZooEffect
- CVE-2025-26944WordPress JetPopup plugin <= 2.0.11 - Broken Access Control VulnerabilityCrocoblock JetPopup
- CVE-2025-26942WordPress JetTricks plugin <= 1.5.1 - Broken Access Control VulnerabilityCrocoblock JetTricks
- CVE-2025-26894WordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerabilityMobeen Abdullah Coming Soon, Maintenance Mode
- CVE-2025-26889WordPress hockeydata LOS plugin <= 1.2.4 - Local File Inclusion vulnerabilityhockeydata LOS
- CVE-2025-26743WordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerabilityTC.K Advance WP Query Search Filter
- CVE-2025-26741WordPress Email Notifications for Updates <= 1.1.6 - Privilege Escalation VulnerabilityAWEOS Email Notifications for Updates
- CVE-2025-32929WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Arbitrary Content Deletion vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Generator for Woo…
- CVE-2025-26992WordPress Landing Page Cat plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerabilityfatcatapps Landing Page Cat
- CVE-2025-3575Insecure Direct Object Reference en Deporsite de T-INNOVAT-INNOVA Deporsite
- CVE-2025-3574Insecure Direct Object Reference on Deporsite by T-INNOVAT-INNOVA Deporsite
- CVE-2024-36842An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Numbe
- CVE-2024-50960A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <=
- CVE-2025-29281In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary
- CVE-2025-29471Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into t
Medium, low and unrated 180
- CVE-2025-32385EspoCRM allows unrestricted Embedding in Iframe dashletespocrm
- CVE-2025-32388SvelteKit allows XSS via tracked search_paramssveltejs kit · @sveltejs/kit
- CVE-2025-32435Hydra no restricted eval after nix-eval-jobs migrationNixOS hydra
- CVE-2025-32782Ash Authentication email link auto-click account confirmation vulnerabilityteam-alembic ash_authentication
- CVE-2025-27929Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-24315Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27561Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-30982WordPress MyBookProgress by Stormhill Media plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityzookatron MyBookProgress by Stormhill Media
- CVE-2025-30966WordPress WPJobBoard plugin < 5.11.1 - Path Traversal vulnerabilityNotFound WPJobBoard
- CVE-2025-26998WordPress SKT Blocks – Gutenberg based Page Builder plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Blocks
- CVE-2025-30257Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-26996WordPress Sign-up Sheets plugin <= 2.3.0.1 - Shortcode Injection vulnerabilityFetch Designs Sign-up Sheets
- CVE-2025-26951WordPress C9 Blocks plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerabilitycovertnine C9 Blocks
- CVE-2025-26950WordPress Nepali Date Converter plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityAddonsPress Nepali Date Converter
- CVE-2025-26934WordPress Glossy Blog theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilitygraphthemes Glossy Blog
- CVE-2025-26930WordPress Home Services plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityalleythemes Home Services
- CVE-2025-26919WordPress Tainá plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilitytainacan Tainá
- CVE-2025-26906WordPress WP Delete User Accounts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityRen Ventura WP Delete User Accounts
- CVE-2025-26903WordPress InPost Gallery plugin <= 2.1.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityRealMag777 InPost Gallery
- CVE-2025-26880WordPress SKT Skill Bar plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Skill Bar
- CVE-2025-26870WordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2025-26749WordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityWPFactory Additional Custom Product Tabs for WooCommerce
- CVE-2025-26740WordPress SpaBiz plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityburgersoftware SpaBiz
- CVE-2025-22269WordPress Real Testimonials plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerabilityShapedPlugin Real Testimonials
- CVE-2025-22268WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - Cross Site Scripting (XSS) vulnerabilityUncanny Owl Uncanny Toolkit for LearnDash
- CVE-2025-31147Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31360Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-30512Growatt Cloud portal External Control of System or Configuration SettingGrowatt Cloud portal
- CVE-2025-27927Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-24850Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-25276Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27565Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27575Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31950Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31945Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-26857Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27719Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31654Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-30514Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27938Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27939Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-30254Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-27568Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-30702Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server.Oracle Database Server
- CVE-2025-32021Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintextWeblateOrg weblate · weblate
- CVE-2025-24487Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-30740Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-30737Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View).Oracle Smart View for Office
- CVE-2025-30733Vulnerability in the RDBMS Listener component of Oracle Database Server.Oracle Database Server
- CVE-2025-30732Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).Oracle Application Object Library
- CVE-2025-30731Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration).Oracle Applications Technology Stack
- CVE-2025-30729Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).Oracle Communications Order and Service Management
- CVE-2025-30726Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).Oracle Application Object Library
- CVE-2025-30725Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-30723Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services).Oracle BI Publisher
- CVE-2025-30722Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump).Oracle MySQL Cluster · Oracle MySQL Client
- CVE-2025-30721Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF).Oracle MySQL Server
- CVE-2025-30720Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders).Oracle Configurator
- CVE-2025-30719Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-30718Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload).Oracle Applications Framework
- CVE-2025-30717Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Diagnostics Scripts).Oracle Teleservice
- CVE-2025-30715Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).Oracle MySQL Server
- CVE-2025-30714Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).Oracle MySQL Connectors
- CVE-2025-30713Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening).Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager
- CVE-2025-30711Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload).Oracle Applications Framework
- CVE-2025-30710Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin).Oracle MySQL Cluster
- CVE-2025-30709Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-30705Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).Oracle MySQL Server
- CVE-2025-30704Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).Oracle MySQL Server
- CVE-2025-30703Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-30700Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module).Oracle Solaris
- CVE-2025-30699Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).Oracle MySQL Server
- CVE-2025-30698Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).Oracle Java SE · Oracle GraalVM for JDK +1
- CVE-2025-30697Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-30696Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).Oracle MySQL Server
- CVE-2025-30695Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-30694Vulnerability in the XML Database component of Oracle Database Server.Oracle Database Server
- CVE-2025-30693Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-30692Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments).Oracle iSupplier Portal
- CVE-2025-30691Vulnerability in Oracle Java SE (component: Compiler).Oracle Java SE
- CVE-2025-30689Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-30688Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-30687Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-30685Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).Oracle MySQL Server
- CVE-2025-30684Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).Oracle MySQL Server
- CVE-2025-30683Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).Oracle MySQL Server
- CVE-2025-30682Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-30681Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21588Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2025-21586Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-21585Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21584Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2025-21583Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2025-21582Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).Oracle CRM Technical Foundation
- CVE-2025-21581Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-21580Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2025-21579Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options).Oracle MySQL Server
- CVE-2025-21578Vulnerability in Oracle Secure Backup (component: General).Oracle Secure Backup
- CVE-2025-21577Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-21576Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server).Oracle Commerce Platform
- CVE-2025-21575Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21574Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2025-21573Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Oracle Financial Services Revenue Management and Billing
- CVE-2025-31941Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31357Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31949Growatt Cloud portal Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-31933Growatt Cloud Applications Authorization Bypass Through User-Controlled KeyGrowatt Cloud portal
- CVE-2025-32012Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofingjellyfin
- CVE-2025-1122Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gaGoogle ChromeOS
- CVE-2025-1292TPM2 Out-Of-Bounds Write Leading to Potential Operating System Verification Bypass in ChromeOSGoogle ChromeOS
- CVE-2025-32439pleezer allows resource exhaustion through uncollected hook script processesroderickvd pleezer · pleezer
- CVE-2025-24358gorilla/csrf CSRF vulnerability due to broken Referer validationgorilla csrf · github.com/gorilla/csrf
- CVE-2023-5616In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activaCanonical Ubuntu's gnome-control-center
- CVE-2024-42193HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attackHCL Software HCL BigFix Platform
- CVE-2024-42189HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attackHCL Software HCL BigFix Platform
- CVE-2024-42200HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attackHCL Software HCL BigFix Platform
- CVE-2025-32779labsai/eddi Vulnerable to Path Traversal (Zip Slip) in ZIP Import Functionlabsai EDDI
- CVE-2025-32776OpenRazer Vulnerable to Out of Bounds Readopenrazer
- CVE-2025-29817Microsoft Power Automate Desktop Information Disclosure VulnerabilityMicrosoft Power Automate for Desktop
- CVE-2024-11084Potential Username Enumeration in Helix ALMPerforce Helix ALM
- CVE-2024-13177Symlink Following in Netskope Client Postinstall ScriptNetskope Client
- CVE-2025-3523User Interface (UI) Misrepresentation of attachment URLMozilla Thunderbird
- CVE-2025-2830Information Disclosure of /tmp directory listingMozilla Thunderbird
- CVE-2025-3522Leak of hashed Window credentials via crafted attachment URLMozilla Thunderbird
- CVE-2025-32949PeerTube User Import Authenticated Resource ExhaustionChocobozzz/PeerTube
- CVE-2025-32946PeerTube Arbitrary Playlist Creation via ActivityPub ProtocolChocobozzz/PeerTube
- CVE-2025-3608Race condition in nsHttpTransaction could lead to memory corruptionMozilla Firefox
- CVE-2025-32945PeerTube Arbitrary Playlist Creation via REST APIChocobozzz/PeerTube
- CVE-2025-32944PeerTube User Import Authenticated Persistent Denial of ServiceChocobozzz/PeerTube
- CVE-2025-30965WordPress WPJobBoard plugin < 5.11.1 - Multiple Cross Site Request Forgery (CSRF) vulnerabilities vulnerabilityNotFound WPJobBoard
- CVE-2025-30964WordPress Photography theme < 7.7.6 - Server Side Request Forgery (SSRF) vulnerabilityThemeGoods Photography
- CVE-2025-26990WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2025-26982WordPress DSGVO Youtube plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEric-Oliver Mächler DSGVO Youtube
- CVE-2025-26955WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerabilityvowelweb Industrial Lite
- CVE-2025-26745WordPress RS Elements Elementor Addon plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerabilityRSTheme RS Elements Elementor Addon
- CVE-2025-26744WordPress JetBlog plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetBlog
- CVE-2025-32943PeerTube HLS Video Files Path TraversalChocobozzz/PeerTube
- CVE-2025-1688System configuration password resetMilestone Systems XProtect VMS
- CVE-2025-2083Logo Carousel Gutenberg Block <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameterbinsaifullah Awesome Logo Carousel Block
- CVE-2024-45712SolarWinds Serv-U Client-Side Cross-Site Scripting VulnerabilitySolarWinds Serv-U
- CVE-2024-13610Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSSSimple Social Media Share Buttons
- CVE-2024-13207Widget for Social Page Feeds < 6.4.2 - Admin+ Stored XSSWidget for Social Page Feeds
- CVE-2025-3576Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisionskrb5 · Red Hat Enterprise Linux +2
- CVE-2025-3622Xorbits Inference model.py load deserializationXorbits Inference
- CVE-2025-2225Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'cyberchimps Responsive Addons for Elementor – Free Elemento…
- CVE-2025-3573Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may jquery-validation
- CVE-2025-29984Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability.Dell Trusted Device Client
- CVE-2025-29983Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability.Dell Trusted Device Client
- CVE-2025-3613Demtec Graphytics visualization cross site scriptingDemtec Graphytics
- CVE-2025-3612Demtec Graphytics HTTP GET Parameter visualization cross site scriptingDemtec Graphytics
- CVE-2025-3470TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parametertotalsoft TS Poll – Survey, Versus Poll, Image Poll, Video…
- CVE-2020-18243SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php.
- CVE-2024-44843An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via s
- CVE-2024-49200An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7.
- CVE-2025-22903TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig.
- CVE-2025-22911RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function.
- CVE-2025-24948In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.
- CVE-2025-24949In JotUrl 2.0, is possible to bypass security requirements during the password change process.
- CVE-2025-25453Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2.
- CVE-2025-25458Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2.
- CVE-2025-27892Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.shopware/core · shopware/platform
- CVE-2025-27980cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=.
- CVE-2025-28136TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi.
- CVE-2025-28142Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the folder
- CVE-2025-28143Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupn
- CVE-2025-28144Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin param
- CVE-2025-28145Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition
- CVE-2025-28198A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of t
- CVE-2025-29213A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a
- CVE-2025-29280Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface a
- CVE-2025-29705code-gen <=2.0.6 is vulnerable to Incorrect Access Control.
- CVE-2025-32102CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request CrushFTP
- CVE-2025-32103CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files acCrushFTP
- CVE-2025-32987Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line inArctera eDiscovery Platform
- CVE-2025-32993Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_usernaVision Helpdesk
- CVE-2025-32996In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.chimurai http-proxy-middleware · http-proxy-middleware
- CVE-2025-32997In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.chimurai http-proxy-middleware · http-proxy-middleware
- CVE-2025-33026In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability.PeaZip
- CVE-2025-33027In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability.Bandisoft Bandizip
- CVE-2025-33028In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.WinZip