# CVEs published 2025-04-15

262 CVEs were published on April 15, 2025: 20 critical, 62 high. Days are UTC.

- [CVE-2025-30215](https://cve.now/CVE-2025-30215.md): NATS-Server Fails to Authorize Certain Jetstream Admin APIs (CVSS 9.6, nats-io nats-server · github.com/nats-io/nats-server/v2)
- [CVE-2025-32385](https://cve.now/CVE-2025-32385.md): EspoCRM allows unrestricted Embedding in Iframe dashlet (CVSS 5.3, espocrm)
- [CVE-2025-32388](https://cve.now/CVE-2025-32388.md): SvelteKit allows XSS via tracked search\_params (CVSS 5.4, sveltejs kit · @sveltejs/kit)
- [CVE-2025-32435](https://cve.now/CVE-2025-32435.md): Hydra no restricted eval after nix-eval-jobs migration (CVSS 2.6, NixOS hydra)
- [CVE-2025-32782](https://cve.now/CVE-2025-32782.md): Ash Authentication email link auto-click account confirmation vulnerability (CVSS 5.3, team-alembic ash\_authentication)
- [CVE-2025-27929](https://cve.now/CVE-2025-27929.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-24315](https://cve.now/CVE-2025-24315.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-32784](https://cve.now/CVE-2025-32784.md): conda-forge-webservices has an Unauthorized Artifact Modification Race Condition (CVSS 7.5, conda-forge-webservices)
- [CVE-2025-27561](https://cve.now/CVE-2025-27561.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-32923](https://cve.now/CVE-2025-32923.md): WordPress Tourmaster plugin \< 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GoodLayers Tourmaster)
- [CVE-2025-30984](https://cve.now/CVE-2025-30984.md): WordPress SEO Tools plugin \<= 4.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dzynit SEO Tools)
- [CVE-2025-30982](https://cve.now/CVE-2025-30982.md): WordPress MyBookProgress by Stormhill Media plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zookatron MyBookProgress by Stormhill Media)
- [CVE-2025-30970](https://cve.now/CVE-2025-30970.md): WordPress Easy Contact plugin \<= 0.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scottwallick Easy Contact)
- [CVE-2025-30967](https://cve.now/CVE-2025-30967.md): WordPress WPJobBoard plugin \< 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability (CVSS 9.6, NotFound WPJobBoard)
- [CVE-2025-30966](https://cve.now/CVE-2025-30966.md): WordPress WPJobBoard plugin \< 5.11.1 - Path Traversal vulnerability (CVSS 5.4, NotFound WPJobBoard)
- [CVE-2025-27011](https://cve.now/CVE-2025-27011.md): WordPress Booking and Rental Manager plugin \<= 2.2.8 - Local File Inclusion vulnerability (CVSS 7.5, magepeopleteam Booking and Rental Manager)
- [CVE-2025-27008](https://cve.now/CVE-2025-27008.md): WordPress Unlimited Timeline \< 1.6.1 - Broken Access Control Vulnerability (CVSS 7.5, NotFound Unlimited Timeline)
- [CVE-2025-26998](https://cve.now/CVE-2025-26998.md): WordPress SKT Blocks – Gutenberg based Page Builder plugin \<= 1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 SKT Blocks)
- [CVE-2025-30257](https://cve.now/CVE-2025-30257.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-26996](https://cve.now/CVE-2025-26996.md): WordPress Sign-up Sheets plugin \<= 2.3.0.1 - Shortcode Injection vulnerability (CVSS 6.5, Fetch Designs Sign-up Sheets)
- [CVE-2025-26953](https://cve.now/CVE-2025-26953.md): WordPress JetMenu plugin \<= 2.4.9 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetMenu)
- [CVE-2025-26951](https://cve.now/CVE-2025-26951.md): WordPress C9 Blocks plugin \<= 1.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, covertnine C9 Blocks)
- [CVE-2025-26950](https://cve.now/CVE-2025-26950.md): WordPress Nepali Date Converter plugin \<= 2.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AddonsPress Nepali Date Converter)
- [CVE-2025-26934](https://cve.now/CVE-2025-26934.md): WordPress Glossy Blog theme \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, graphthemes Glossy Blog)
- [CVE-2025-26930](https://cve.now/CVE-2025-26930.md): WordPress Home Services plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, alleythemes Home Services)
- [CVE-2025-26927](https://cve.now/CVE-2025-26927.md): WordPress AI Hub plugin \<= 1.3.7 - Arbitrary File Upload vulnerability (CVSS 10.0, LiquidThemes AI Hub)
- [CVE-2025-26919](https://cve.now/CVE-2025-26919.md): WordPress Tainá plugin \<= 0.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tainacan Tainá)
- [CVE-2025-26908](https://cve.now/CVE-2025-26908.md): WordPress Kargo Entegratör plugin \<= 1.1.14 - SQL Injection vulnerability (CVSS 7.6, Gurmehub Kargo Entegratör)
- [CVE-2025-26906](https://cve.now/CVE-2025-26906.md): WordPress WP Delete User Accounts plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ren Ventura WP Delete User Accounts)
- [CVE-2025-26903](https://cve.now/CVE-2025-26903.md): WordPress InPost Gallery plugin \<= 2.1.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, RealMag777 InPost Gallery)
- [CVE-2025-26880](https://cve.now/CVE-2025-26880.md): WordPress SKT Skill Bar plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 SKT Skill Bar)
- [CVE-2025-26870](https://cve.now/CVE-2025-26870.md): WordPress JetEngine plugin \<= 3.6.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2025-26749](https://cve.now/CVE-2025-26749.md): WordPress Additional Custom Product Tabs for WooCommerce plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPFactory Additional Custom Product Tabs for WooCommerce)
- [CVE-2025-26748](https://cve.now/CVE-2025-26748.md): WordPress Arkhe theme \<= 3.12.0 - CSRF to Local File Inclusion vulnerability (CVSS 8.1, looswebstudio Arkhe)
- [CVE-2025-26746](https://cve.now/CVE-2025-26746.md): WordPress Advanced Custom Fields: Link Picker Field plugin \<= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, caalami Advanced Custom Fields: Link Picker Field)
- [CVE-2025-26740](https://cve.now/CVE-2025-26740.md): WordPress SpaBiz plugin \<= 1.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, burgersoftware SpaBiz)
- [CVE-2025-26730](https://cve.now/CVE-2025-26730.md): WordPress Macro Calculator with Admin Email Optin & Data plugin \<= 1.0 - Multiple Vulnerabilities vulnerability (CVSS 7.5, NotFound Macro Calculator with Admin Email Optin & Data)
- [CVE-2025-22269](https://cve.now/CVE-2025-22269.md): WordPress Real Testimonials plugin \<= 3.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ShapedPlugin Real Testimonials)
- [CVE-2025-22268](https://cve.now/CVE-2025-22268.md): WordPress Uncanny Toolkit for LearnDash plugin \<= 3.7.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Uncanny Owl Uncanny Toolkit for LearnDash)
- [CVE-2025-22263](https://cve.now/CVE-2025-22263.md): WordPress Global Gallery plugin \<= 8.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound Global Gallery)
- [CVE-2025-31147](https://cve.now/CVE-2025-31147.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-31360](https://cve.now/CVE-2025-31360.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-30512](https://cve.now/CVE-2025-30512.md): Growatt Cloud portal External Control of System or Configuration Setting (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-27927](https://cve.now/CVE-2025-27927.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-24297](https://cve.now/CVE-2025-24297.md): Growatt Cloud portal Cross-site Scripting (CVSS 9.3, Growatt Cloud portal)
- [CVE-2025-30510](https://cve.now/CVE-2025-30510.md): Growatt Cloud portal Insufficient Type Distinction (CVSS 9.3, Growatt Cloud portal)
- [CVE-2025-24850](https://cve.now/CVE-2025-24850.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-25276](https://cve.now/CVE-2025-25276.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-27565](https://cve.now/CVE-2025-27565.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-27575](https://cve.now/CVE-2025-27575.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-31950](https://cve.now/CVE-2025-31950.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-31945](https://cve.now/CVE-2025-31945.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-26857](https://cve.now/CVE-2025-26857.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-27719](https://cve.now/CVE-2025-27719.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-31654](https://cve.now/CVE-2025-31654.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-30514](https://cve.now/CVE-2025-30514.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-27938](https://cve.now/CVE-2025-27938.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-27939](https://cve.now/CVE-2025-27939.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-1274](https://cve.now/CVE-2025-1274.md): RCS File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +2)
- [CVE-2025-1277](https://cve.now/CVE-2025-1277.md): PDF File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +2)
- [CVE-2025-30254](https://cve.now/CVE-2025-30254.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-1656](https://cve.now/CVE-2025-1656.md): PDF File Parsing Heap-based Overflow Vulnerability (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +2)
- [CVE-2025-1273](https://cve.now/CVE-2025-1273.md): PDF File Parsing Heap-Based Overflow Vulnerability (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +2)
- [CVE-2025-2497](https://cve.now/CVE-2025-2497.md): DWG File Parsing Stack-Based Buffer Vulnerability (CVSS 7.8, Autodesk Revit)
- [CVE-2025-1276](https://cve.now/CVE-2025-1276.md): DWG File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Advance Steel +2)
- [CVE-2025-1275](https://cve.now/CVE-2025-1275.md): JPG File Parsing Heap-Based Overflow Vulnerability (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +3)
- [CVE-2025-27568](https://cve.now/CVE-2025-27568.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-30702](https://cve.now/CVE-2025-30702.md): Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. (CVSS 5.3, Oracle Database Server)
- [CVE-2025-32021](https://cve.now/CVE-2025-32021.md): Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext (CVSS 2.2, WeblateOrg weblate · weblate)
- [CVE-2025-31499](https://cve.now/CVE-2025-31499.md): Jellyfin Vulnerable to Argument Injection in FFmpeg (CVSS 7.6, jellyfin)
- [CVE-2025-24487](https://cve.now/CVE-2025-24487.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-30740](https://cve.now/CVE-2025-30740.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.5, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-30737](https://cve.now/CVE-2025-30737.md): Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View). (CVSS 5.7, Oracle Smart View for Office)
- [CVE-2025-30736](https://cve.now/CVE-2025-30736.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 7.4, Oracle Database Server)
- [CVE-2025-30735](https://cve.now/CVE-2025-30735.md): Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configurati (CVSS 8.1, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2025-30733](https://cve.now/CVE-2025-30733.md): Vulnerability in the RDBMS Listener component of Oracle Database Server. (CVSS 6.5, Oracle Database Server)
- [CVE-2025-30732](https://cve.now/CVE-2025-30732.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 6.1, Oracle Application Object Library)
- [CVE-2025-30731](https://cve.now/CVE-2025-30731.md): Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). (CVSS 3.6, Oracle Applications Technology Stack)
- [CVE-2025-30730](https://cve.now/CVE-2025-30730.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.5, Oracle Application Object Library)
- [CVE-2025-30729](https://cve.now/CVE-2025-30729.md): Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). (CVSS 5.5, Oracle Communications Order and Service Management)
- [CVE-2025-30728](https://cve.now/CVE-2025-30728.md): Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). (CVSS 7.5, Oracle Configurator)
- [CVE-2025-30727](https://cve.now/CVE-2025-30727.md): Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). (CVSS 9.8, Oracle Scripting)
- [CVE-2025-30726](https://cve.now/CVE-2025-30726.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 5.3, Oracle Application Object Library)
- [CVE-2025-30725](https://cve.now/CVE-2025-30725.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.7, Oracle VM VirtualBox)
- [CVE-2025-30724](https://cve.now/CVE-2025-30724.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). (CVSS 7.5, Oracle BI Publisher)
- [CVE-2025-30723](https://cve.now/CVE-2025-30723.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). (CVSS 5.4, Oracle BI Publisher)
- [CVE-2025-30722](https://cve.now/CVE-2025-30722.md): Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). (CVSS 5.3, Oracle MySQL Cluster · Oracle MySQL Client)
- [CVE-2025-30721](https://cve.now/CVE-2025-30721.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). (CVSS 4.0, Oracle MySQL Server)
- [CVE-2025-30720](https://cve.now/CVE-2025-30720.md): Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). (CVSS 6.1, Oracle Configurator)
- [CVE-2025-30719](https://cve.now/CVE-2025-30719.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox)
- [CVE-2025-30718](https://cve.now/CVE-2025-30718.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). (CVSS 5.4, Oracle Applications Framework)
- [CVE-2025-30717](https://cve.now/CVE-2025-30717.md): Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Diagnostics Scripts). (CVSS 6.5, Oracle Teleservice)
- [CVE-2025-30716](https://cve.now/CVE-2025-30716.md): Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). (CVSS 7.5, Oracle Common Applications)
- [CVE-2025-30715](https://cve.now/CVE-2025-30715.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30714](https://cve.now/CVE-2025-30714.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). (CVSS 4.8, Oracle MySQL Connectors)
- [CVE-2025-30713](https://cve.now/CVE-2025-30713.md): Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). (CVSS 5.4, Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager)
- [CVE-2025-30712](https://cve.now/CVE-2025-30712.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2025-30711](https://cve.now/CVE-2025-30711.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). (CVSS 5.4, Oracle Applications Framework)
- [CVE-2025-30710](https://cve.now/CVE-2025-30710.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). (CVSS 4.9, Oracle MySQL Cluster)
- [CVE-2025-30709](https://cve.now/CVE-2025-30709.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-30708](https://cve.now/CVE-2025-30708.md): Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search and Register Users). (CVSS 7.5, Oracle User Management)
- [CVE-2025-30707](https://cve.now/CVE-2025-30707.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). (CVSS 7.5, Oracle iStore)
- [CVE-2025-30706](https://cve.now/CVE-2025-30706.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). (CVSS 7.5, Oracle MySQL Connectors)
- [CVE-2025-30705](https://cve.now/CVE-2025-30705.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30704](https://cve.now/CVE-2025-30704.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2025-30703](https://cve.now/CVE-2025-30703.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2025-30701](https://cve.now/CVE-2025-30701.md): Vulnerability in the RAS Security component of Oracle Database Server. (CVSS 7.3, Oracle Database Server)
- [CVE-2025-30700](https://cve.now/CVE-2025-30700.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). (CVSS 3.5, Oracle Solaris)
- [CVE-2025-30699](https://cve.now/CVE-2025-30699.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30698](https://cve.now/CVE-2025-30698.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). (CVSS 5.6, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-30697](https://cve.now/CVE-2025-30697.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). (CVSS 5.4, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-30696](https://cve.now/CVE-2025-30696.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30695](https://cve.now/CVE-2025-30695.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-30694](https://cve.now/CVE-2025-30694.md): Vulnerability in the XML Database component of Oracle Database Server. (CVSS 5.4, Oracle Database Server)
- [CVE-2025-30693](https://cve.now/CVE-2025-30693.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-30692](https://cve.now/CVE-2025-30692.md): Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). (CVSS 6.5, Oracle iSupplier Portal)
- [CVE-2025-30691](https://cve.now/CVE-2025-30691.md): Vulnerability in Oracle Java SE (component: Compiler). (CVSS 4.8, Oracle Java SE)
- [CVE-2025-30690](https://cve.now/CVE-2025-30690.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 7.2, Oracle Solaris)
- [CVE-2025-30689](https://cve.now/CVE-2025-30689.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30688](https://cve.now/CVE-2025-30688.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-30687](https://cve.now/CVE-2025-30687.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-30686](https://cve.now/CVE-2025-30686.md): Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: EMC). (CVSS 7.6, Oracle Hospitality Simphony)
- [CVE-2025-30685](https://cve.now/CVE-2025-30685.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30684](https://cve.now/CVE-2025-30684.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30683](https://cve.now/CVE-2025-30683.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-30682](https://cve.now/CVE-2025-30682.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-30681](https://cve.now/CVE-2025-30681.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 2.7, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21588](https://cve.now/CVE-2025-21588.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21587](https://cve.now/CVE-2025-21587.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 7.4, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-21586](https://cve.now/CVE-2025-21586.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-21585](https://cve.now/CVE-2025-21585.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21584](https://cve.now/CVE-2025-21584.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21583](https://cve.now/CVE-2025-21583.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21582](https://cve.now/CVE-2025-21582.md): Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). (CVSS 6.1, Oracle CRM Technical Foundation)
- [CVE-2025-21581](https://cve.now/CVE-2025-21581.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21580](https://cve.now/CVE-2025-21580.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21579](https://cve.now/CVE-2025-21579.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-21578](https://cve.now/CVE-2025-21578.md): Vulnerability in Oracle Secure Backup (component: General). (CVSS 6.7, Oracle Secure Backup)
- [CVE-2025-21577](https://cve.now/CVE-2025-21577.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-21576](https://cve.now/CVE-2025-21576.md): Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server). (CVSS 5.4, Oracle Commerce Platform)
- [CVE-2025-21575](https://cve.now/CVE-2025-21575.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). (CVSS 6.5, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21574](https://cve.now/CVE-2025-21574.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). (CVSS 6.5, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-21573](https://cve.now/CVE-2025-21573.md): Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: (CVSS 6.0, Oracle Financial Services Revenue Management and Billing)
- [CVE-2025-31941](https://cve.now/CVE-2025-31941.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-31357](https://cve.now/CVE-2025-31357.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-32778](https://cve.now/CVE-2025-32778.md): Web-Check allows command Injection via Unvalidated URL in Screenshot API (CVSS 9.3, Lissy93 web-check)
- [CVE-2025-31949](https://cve.now/CVE-2025-31949.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-31933](https://cve.now/CVE-2025-31933.md): Growatt Cloud Applications Authorization Bypass Through User-Controlled Key (CVSS 6.9, Growatt Cloud portal)
- [CVE-2025-30511](https://cve.now/CVE-2025-30511.md): Growatt Cloud Applications Cross-site Scripting (CVSS 8.7, Growatt Cloud portal)
- [CVE-2025-32012](https://cve.now/CVE-2025-32012.md): Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing (CVSS 4.6, jellyfin)
- [CVE-2025-31497](https://cve.now/CVE-2025-31497.md): TEIGarage XML External Entity (XXE) Injection in Document Conversion Service (CVSS 7.5, TEIC TEIGarage)
- [CVE-2025-2567](https://cve.now/CVE-2025-2567.md): Lantronix Xport Missing Authentication for Critical Function (CVSS 9.8, Lantronix Xport)
- [CVE-2025-32438](https://cve.now/CVE-2025-32438.md): Local privilege escalation in make-initrd-ng (CVSS 8.8, NixOS nixpkgs)
- [CVE-2025-1122](https://cve.now/CVE-2025-1122.md): Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to ga (CVSS 6.7, Google ChromeOS)
- [CVE-2025-1292](https://cve.now/CVE-2025-1292.md): TPM2 Out-Of-Bounds Write Leading to Potential Operating System Verification Bypass in ChromeOS (CVSS 6.7, Google ChromeOS)
- [CVE-2025-32439](https://cve.now/CVE-2025-32439.md): pleezer allows resource exhaustion through uncollected hook script processes (CVSS 6.5, roderickvd pleezer · pleezer)
- [CVE-2025-32445](https://cve.now/CVE-2025-32445.md): Users can gain privileged access to the host system and cluster with EventSource and Sensor CR (CVSS 10.0, argoproj argo-events · github.com/argoproj/argo-events)
- [CVE-2025-30206](https://cve.now/CVE-2025-30206.md): Dpanel's hard-coded JWT secret leads to remote code execution (CVSS 9.8, donknap dpanel · github.com/donknap/dpanel)
- [CVE-2025-27791](https://cve.now/CVE-2025-27791.md): Collabora Online Vulnerable to Arbitrary File Write (CVSS 8.3, CollaboraOnline online)
- [CVE-2025-24358](https://cve.now/CVE-2025-24358.md): gorilla/csrf CSRF vulnerability due to broken Referer validation (CVSS 5.4, gorilla csrf · github.com/gorilla/csrf)
- [CVE-2023-5616](https://cve.now/CVE-2023-5616.md): In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activa (CVSS 4.9, Canonical Ubuntu's gnome-control-center)
- [CVE-2024-42193](https://cve.now/CVE-2024-42193.md): HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack (CVSS 2.1, HCL Software HCL BigFix Platform)
- [CVE-2024-42189](https://cve.now/CVE-2024-42189.md): HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack (CVSS 5.6, HCL Software HCL BigFix Platform)
- [CVE-2024-42200](https://cve.now/CVE-2024-42200.md): HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack (CVSS 4.8, HCL Software HCL BigFix Platform)
- [CVE-2025-3618](https://cve.now/CVE-2025-3618.md): Local Privilege Escalation Vulnerability (CVSS 8.5, Rockwell Automation ThinManager)
- [CVE-2025-3617](https://cve.now/CVE-2025-3617.md): Local Privilege Escalation in ThinManager® (CVSS 8.5, Rockwell Automation ThinManager®)
- [CVE-2025-32780](https://cve.now/CVE-2025-32780.md): BleachBit for Windows Has DLL Untrusted Path Vulnerability (CVSS 7.3, bleachbit)
- [CVE-2025-32779](https://cve.now/CVE-2025-32779.md): labsai/eddi Vulnerable to Path Traversal (Zip Slip) in ZIP Import Function (CVSS 6.5, labsai EDDI)
- [CVE-2025-32776](https://cve.now/CVE-2025-32776.md): OpenRazer Vulnerable to Out of Bounds Read (CVSS 5.5, openrazer)
- [CVE-2025-29817](https://cve.now/CVE-2025-29817.md): Microsoft Power Automate Desktop Information Disclosure Vulnerability (CVSS 5.7, Microsoft Power Automate for Desktop)
- [CVE-2025-32911](https://cve.now/CVE-2025-32911.md): Libsoup: double free on soup\_message\_headers\_get\_content\_disposition() through "soup-message-headers.c" via "params" ghashtable value (CVSS 9.0, libsoup · Red Hat Enterprise Linux 7 Extended Lifecycle… +1)
- [CVE-2024-11084](https://cve.now/CVE-2024-11084.md): Potential Username Enumeration in Helix ALM (CVSS 6.3, Perforce Helix ALM)
- [CVE-2024-13177](https://cve.now/CVE-2024-13177.md): Symlink Following in Netskope Client Postinstall Script (CVSS 5.2, Netskope Client)
- [CVE-2025-3523](https://cve.now/CVE-2025-3523.md): User Interface (UI) Misrepresentation of attachment URL (CVSS 6.4, Mozilla Thunderbird)
- [CVE-2025-2830](https://cve.now/CVE-2025-2830.md): Information Disclosure of /tmp directory listing (CVSS 6.3, Mozilla Thunderbird)
- [CVE-2025-3522](https://cve.now/CVE-2025-3522.md): Leak of hashed Window credentials via crafted attachment URL (CVSS 6.3, Mozilla Thunderbird)
- [CVE-2025-32949](https://cve.now/CVE-2025-32949.md): PeerTube User Import Authenticated Resource Exhaustion (CVSS 6.5, Chocobozzz/PeerTube)
- [CVE-2025-32948](https://cve.now/CVE-2025-32948.md): PeerTube ActivityPub Playlist Creation Blind SSRF and DoS (CVSS 7.5, Chocobozzz/PeerTube)
- [CVE-2025-32947](https://cve.now/CVE-2025-32947.md): PeerTube ActivityPub Crawl Infinite Loop DoS (CVSS 7.5, Chocobozzz/PeerTube)
- [CVE-2025-32946](https://cve.now/CVE-2025-32946.md): PeerTube Arbitrary Playlist Creation via ActivityPub Protocol (CVSS 5.3, Chocobozzz/PeerTube)
- [CVE-2025-3608](https://cve.now/CVE-2025-3608.md): Race condition in nsHttpTransaction could lead to memory corruption (CVSS 6.5, Mozilla Firefox)
- [CVE-2025-32945](https://cve.now/CVE-2025-32945.md): PeerTube Arbitrary Playlist Creation via REST API (CVSS 4.3, Chocobozzz/PeerTube)
- [CVE-2025-32944](https://cve.now/CVE-2025-32944.md): PeerTube User Import Authenticated Persistent Denial of Service (CVSS 6.5, Chocobozzz/PeerTube)
- [CVE-2025-31011](https://cve.now/CVE-2025-31011.md): WordPress SimplyRETS Real Estate IDX plugin \<= 3.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ReichertBrothers SimplyRETS Real Estate IDX)
- [CVE-2025-30985](https://cve.now/CVE-2025-30985.md): WordPress GNUCommerce plugin \<= 1.5.4 - PHP Object Injection vulnerability (CVSS 9.8, kagla GNUCommerce)
- [CVE-2025-30965](https://cve.now/CVE-2025-30965.md): WordPress WPJobBoard plugin \< 5.11.1 - Multiple Cross Site Request Forgery (CSRF) vulnerabilities vulnerability (CVSS 4.3, NotFound WPJobBoard)
- [CVE-2025-30964](https://cve.now/CVE-2025-30964.md): WordPress Photography theme \< 7.7.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, ThemeGoods Photography)
- [CVE-2025-30962](https://cve.now/CVE-2025-30962.md): WordPress FS Poster plugin \<= 6.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fs-code FS Poster)
- [CVE-2025-26990](https://cve.now/CVE-2025-26990.md): WordPress Royal Elementor Addons plugin \<= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, WP Royal Royal Elementor Addons)
- [CVE-2025-26982](https://cve.now/CVE-2025-26982.md): WordPress DSGVO Youtube plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eric-Oliver Mächler DSGVO Youtube)
- [CVE-2025-26959](https://cve.now/CVE-2025-26959.md): WordPress Administrator Z \<= 2025.03.24 - Privilege Escalation Vulnerability (CVSS 8.8, Quý Lê 91 Administrator Z)
- [CVE-2025-26958](https://cve.now/CVE-2025-26958.md): WordPress JetBlog plugin \<= 2.4.3 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetBlog)
- [CVE-2025-26955](https://cve.now/CVE-2025-26955.md): WordPress Industrial Lite theme \<= 1.0.8 - Broken Access Control vulnerability (CVSS 4.3, vowelweb Industrial Lite)
- [CVE-2025-26954](https://cve.now/CVE-2025-26954.md): WordPress ZooEffect plugin \<= 1.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 1pluginjquery ZooEffect)
- [CVE-2025-26944](https://cve.now/CVE-2025-26944.md): WordPress JetPopup plugin \<= 2.0.11 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetPopup)
- [CVE-2025-26942](https://cve.now/CVE-2025-26942.md): WordPress JetTricks plugin \<= 1.5.1 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetTricks)
- [CVE-2025-26894](https://cve.now/CVE-2025-26894.md): WordPress Coming Soon, Maintenance Mode plugin \<= 1.1.1 - Local File Inclusion vulnerability (CVSS 7.5, Mobeen Abdullah Coming Soon, Maintenance Mode)
- [CVE-2025-26889](https://cve.now/CVE-2025-26889.md): WordPress hockeydata LOS plugin \<= 1.2.4 - Local File Inclusion vulnerability (CVSS 7.5, hockeydata LOS)
- [CVE-2025-26745](https://cve.now/CVE-2025-26745.md): WordPress RS Elements Elementor Addon plugin \<= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RSTheme RS Elements Elementor Addon)
- [CVE-2025-26744](https://cve.now/CVE-2025-26744.md): WordPress JetBlog plugin \<= 2.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetBlog)
- [CVE-2025-26743](https://cve.now/CVE-2025-26743.md): WordPress Advance WP Query Search Filter plugin \<= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TC.K Advance WP Query Search Filter)
- [CVE-2025-26741](https://cve.now/CVE-2025-26741.md): WordPress Email Notifications for Updates \<= 1.1.6 - Privilege Escalation Vulnerability (CVSS 8.8, AWEOS Email Notifications for Updates)
- [CVE-2025-32929](https://cve.now/CVE-2025-32929.md): WordPress Barcode Generator for WooCommerce plugin \<= 2.0.4 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Dmitry V. (CEO of "UKR Solution") Barcode Generator for Woo…)
- [CVE-2025-26992](https://cve.now/CVE-2025-26992.md): WordPress Landing Page Cat plugin \<= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fatcatapps Landing Page Cat)
- [CVE-2025-32943](https://cve.now/CVE-2025-32943.md): PeerTube HLS Video Files Path Traversal (CVSS 3.7, Chocobozzz/PeerTube)
- [CVE-2025-1688](https://cve.now/CVE-2025-1688.md): System configuration password reset (CVSS 5.5, Milestone Systems XProtect VMS)
- [CVE-2025-2083](https://cve.now/CVE-2025-2083.md): Logo Carousel Gutenberg Block \<= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter (CVSS 6.4, binsaifullah Awesome Logo Carousel Block)
- [CVE-2025-3575](https://cve.now/CVE-2025-3575.md): Insecure Direct Object Reference en Deporsite de T-INNOVA (CVSS 8.7, T-INNOVA Deporsite)
- [CVE-2025-3574](https://cve.now/CVE-2025-3574.md): Insecure Direct Object Reference on Deporsite by T-INNOVA (CVSS 8.7, T-INNOVA Deporsite)
- [CVE-2025-3579](https://cve.now/CVE-2025-3579.md): Code Injection Vulnerability in AiDex (CVSS 9.3, AiDex)
- [CVE-2025-3578](https://cve.now/CVE-2025-3578.md): Adversarial Input Handling Vulnerability in AiDex (CVSS 9.3, AiDex)
- [CVE-2024-45712](https://cve.now/CVE-2024-45712.md): SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability (CVSS 2.6, SolarWinds Serv-U)
- [CVE-2024-13610](https://cve.now/CVE-2024-13610.md): Simple Social Media Share Buttons \< 6.0.0 - Admin+ Stored XSS (CVSS 4.8, Simple Social Media Share Buttons)
- [CVE-2024-13207](https://cve.now/CVE-2024-13207.md): Widget for Social Page Feeds \< 6.4.2 - Admin+ Stored XSS (CVSS 4.8, Widget for Social Page Feeds)
- [CVE-2025-3576](https://cve.now/CVE-2025-3576.md): Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions (CVSS 5.9, krb5 · Red Hat Enterprise Linux +2)
- [CVE-2025-3622](https://cve.now/CVE-2025-3622.md): Xorbits Inference model.py load deserialization (CVSS 5.1, Xorbits Inference)
- [CVE-2025-2225](https://cve.now/CVE-2025-2225.md): Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \<= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael\_title\_tag' (CVSS 6.4, cyberchimps Responsive Addons for Elementor – Free Elemento…)
- [CVE-2025-3573](https://cve.now/CVE-2025-3573.md): Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may (CVSS 5.3, jquery-validation)
- [CVE-2025-29984](https://cve.now/CVE-2025-29984.md): Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability. (CVSS 6.7, Dell Trusted Device Client)
- [CVE-2025-29983](https://cve.now/CVE-2025-29983.md): Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. (CVSS 6.7, Dell Trusted Device Client)
- [CVE-2025-3613](https://cve.now/CVE-2025-3613.md): Demtec Graphytics visualization cross site scripting (CVSS 5.1, Demtec Graphytics)
- [CVE-2025-3612](https://cve.now/CVE-2025-3612.md): Demtec Graphytics HTTP GET Parameter visualization cross site scripting (CVSS 5.3, Demtec Graphytics)
- [CVE-2025-3470](https://cve.now/CVE-2025-3470.md): TS Poll – Survey, Versus Poll, Image Poll, Video Poll \<= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9, totalsoft TS Poll – Survey, Versus Poll, Image Poll, Video…)
- [CVE-2020-18243](https://cve.now/CVE-2020-18243.md): SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php. (CVSS 6.5)
- [CVE-2021-27289](https://cve.now/CVE-2021-27289.md): A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = (CVSS 9.1)
- [CVE-2024-36842](https://cve.now/CVE-2024-36842.md): An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L\_V3.2\_20220301, and Build Numbe (CVSS 7.3)
- [CVE-2024-44843](https://cve.now/CVE-2024-44843.md): An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via s (CVSS 5.9)
- [CVE-2024-49200](https://cve.now/CVE-2024-49200.md): An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. (CVSS 6.4)
- [CVE-2024-50960](https://cve.now/CVE-2024-50960.md): A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 \<=3.01, SMP 351 \<=2.16, SMP 352 \<= (CVSS 7.2)
- [CVE-2025-22900](https://cve.now/CVE-2025-22900.md): Totolink N600R v4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function (CVSS 9.8)
- [CVE-2025-22903](https://cve.now/CVE-2025-22903.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig. (CVSS 4.6)
- [CVE-2025-22911](https://cve.now/CVE-2025-22911.md): RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function. (CVSS 5.6)
- [CVE-2025-24948](https://cve.now/CVE-2025-24948.md): In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records. (CVSS 6.5)
- [CVE-2025-24949](https://cve.now/CVE-2025-24949.md): In JotUrl 2.0, is possible to bypass security requirements during the password change process. (CVSS 6.5)
- [CVE-2025-25453](https://cve.now/CVE-2025-25453.md): Tenda AC10 V4.0si\_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2. (CVSS 4.6)
- [CVE-2025-25456](https://cve.now/CVE-2025-25456.md): Tenda AC10 V4.0si\_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2. (CVSS 9.8)
- [CVE-2025-25458](https://cve.now/CVE-2025-25458.md): Tenda AC10 V4.0si\_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2. (CVSS 4.6)
- [CVE-2025-27892](https://cve.now/CVE-2025-27892.md): Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. (CVSS 6.8, shopware/core · shopware/platform)
- [CVE-2025-27980](https://cve.now/CVE-2025-27980.md): cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=. (CVSS 6.5)
- [CVE-2025-28100](https://cve.now/CVE-2025-28100.md): A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at t (CVSS 9.8)
- [CVE-2025-28136](https://cve.now/CVE-2025-28136.md): TOTOLINK A800R V4.1.2cu.5137\_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi. (CVSS 6.5)
- [CVE-2025-28137](https://cve.now/CVE-2025-28137.md): The TOTOLINK A810R V4.1.2cu.5182\_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg… (CVSS 9.8)
- [CVE-2025-28142](https://cve.now/CVE-2025-28142.md): Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3\_1.0.15 was discovered to contain a command injection vulnerability via the folder (CVSS 6.5)
- [CVE-2025-28143](https://cve.now/CVE-2025-28143.md): Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3\_1.0.15 was discovered to contain a command injection vulnerability via the groupn (CVSS 6.5)
- [CVE-2025-28144](https://cve.now/CVE-2025-28144.md): Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin param (CVSS 6.5)
- [CVE-2025-28145](https://cve.now/CVE-2025-28145.md): Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition (CVSS 6.5)
- [CVE-2025-28198](https://cve.now/CVE-2025-28198.md): A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of t (CVSS 5.9)
- [CVE-2025-28399](https://cve.now/CVE-2025-28399.md): An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Control (CVSS 9.8)
- [CVE-2025-29213](https://cve.now/CVE-2025-29213.md): A zip slip vulnerability in the component \\service\\migrate\\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a (CVSS 5.5)
- [CVE-2025-29280](https://cve.now/CVE-2025-29280.md): Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface a (CVSS 4.8)
- [CVE-2025-29281](https://cve.now/CVE-2025-29281.md): In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary (CVSS 8.8)
- [CVE-2025-29471](https://cve.now/CVE-2025-29471.md): Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into t (CVSS 8.3)
- [CVE-2025-29705](https://cve.now/CVE-2025-29705.md): code-gen \<=2.0.6 is vulnerable to Incorrect Access Control. (CVSS 4.3)
- [CVE-2025-32102](https://cve.now/CVE-2025-32102.md): CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request (CVSS 5.0, CrushFTP)
- [CVE-2025-32103](https://cve.now/CVE-2025-32103.md): CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files ac (CVSS 5.0, CrushFTP)
- [CVE-2025-32987](https://cve.now/CVE-2025-32987.md): Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in (CVSS 6.0, Arctera eDiscovery Platform)
- [CVE-2025-32993](https://cve.now/CVE-2025-32993.md): Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis\_userna (CVSS 6.5, Vision Helpdesk)
- [CVE-2025-32996](https://cve.now/CVE-2025-32996.md): In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. (CVSS 4.0, chimurai http-proxy-middleware · http-proxy-middleware)
- [CVE-2025-32997](https://cve.now/CVE-2025-32997.md): In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. (CVSS 4.0, chimurai http-proxy-middleware · http-proxy-middleware)
- [CVE-2025-33026](https://cve.now/CVE-2025-33026.md): In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. (CVSS 6.1, PeaZip)
- [CVE-2025-33027](https://cve.now/CVE-2025-33027.md): In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. (CVSS 6.1, Bandisoft Bandizip)
- [CVE-2025-33028](https://cve.now/CVE-2025-33028.md): In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. (CVSS 6.1, WinZip)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.