# CVEs published 2025-04-16

373 CVEs were published on April 16, 2025: 23 critical, 147 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-1568](https://cve.now/CVE-2025-1568.md): Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered G (CVSS 8.8, Google ChromeOS)
- [CVE-2025-2073](https://cve.now/CVE-2025-2073.md): Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS \[6.1, 5.15, 5.10, 5.4, 4.19\] allows a local attacker with low privileges to t (CVSS 8.8, Google ChromeOS)
- [CVE-2025-1704](https://cve.now/CVE-2025-1704.md): ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access t (CVSS 6.5, Google ChromeOS)
- [CVE-2025-1566](https://cve.now/CVE-2025-1566.md): DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries (CVSS 7.5, Google ChromeOS)
- [CVE-2025-24907](https://cve.now/CVE-2025-24907.md): Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal (CVSS 6.8, Hitachi Vantara Pentaho Data Integration & Analytics)
- [CVE-2025-24911](https://cve.now/CVE-2025-24911.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 4.9, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2025-24910](https://cve.now/CVE-2025-24910.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 4.9, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2025-24909](https://cve.now/CVE-2025-24909.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2025-24908](https://cve.now/CVE-2025-24908.md): Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal (CVSS 6.8, Hitachi Vantara Pentaho Data Integration & Analytics)
- [CVE-2025-0756](https://cve.now/CVE-2025-0756.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 9.1, Hitachi Vantara Pentaho Data Integration & Analytics)
- [CVE-2025-0757](https://cve.now/CVE-2025-0757.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2025-0758](https://cve.now/CVE-2025-0758.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource (CVSS 6.1, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2025-32791](https://cve.now/CVE-2025-32791.md): Permission policy information leakage in Backstage permission system (CVSS 4.3, backstage · @backstage/plugin-permission-backend)
- [CVE-2025-32789](https://cve.now/CVE-2025-32789.md): EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function (CVSS 3.1, espocrm)
- [CVE-2025-32787](https://cve.now/CVE-2025-32787.md): SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA (CVSS 3.1, SoftEtherVPN)
- [CVE-2025-32783](https://cve.now/CVE-2025-32783.md): XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki (CVSS 4.7, xwiki-platform · org.xwiki.platform:xwiki-platform-messages…)
- [CVE-2025-32433](https://cve.now/CVE-2025-32433.md): Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (CVSS 10.0, KEV, erlang otp)
- [CVE-2025-25230](https://cve.now/CVE-2025-25230.md): Omnissa Horizon Client for Windows contains an LPE Vulnerability. (CVSS 7.8, Omnissa Horizon Client for Windows)
- [CVE-2025-31478](https://cve.now/CVE-2025-31478.md): Zulip Authentication Backend Configuration Bypass (CVSS 8.2, zulip)
- [CVE-2025-3730](https://cve.now/CVE-2025-3730.md): PyTorch LossCTC.cpp torch.nn.functional.ctc\_loss denial of service (CVSS 4.8, PyTorch · torch)
- [CVE-2025-3729](https://cve.now/CVE-2025-3729.md): SourceCodester Web-based Pharmacy Product Management System Database Backup backup.php os command injection (CVSS 6.9, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-3620](https://cve.now/CVE-2025-3620.md): Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2025-3619](https://cve.now/CVE-2025-3619.md): Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corr (CVSS 8.8, Google Chrome)
- [CVE-2025-3728](https://cve.now/CVE-2025-3728.md): SourceCodester Simple Hotel Booking System login buffer overflow (CVSS 4.8, SourceCodester Simple Hotel Booking System)
- [CVE-2025-3727](https://cve.now/CVE-2025-3727.md): PCMan FTP Server STATUS Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3726](https://cve.now/CVE-2025-3726.md): PCMan FTP Server CD Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3725](https://cve.now/CVE-2025-3725.md): PCMan FTP Server MIC Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3724](https://cve.now/CVE-2025-3724.md): PCMan FTP Server DIR Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3723](https://cve.now/CVE-2025-3723.md): PCMan FTP Server MDTM Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-32817](https://cve.now/CVE-2025-32817.md): A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthoriz (CVSS 6.1, SonicWall Connect Tunnel)
- [CVE-2025-31200](https://cve.now/CVE-2025-31200.md): A memory corruption issue was addressed with improved bounds checking. (CVSS 9.8, KEV, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-31201](https://cve.now/CVE-2025-31201.md): This issue was addressed by removing the vulnerable code. (CVSS 9.8, KEV, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-2291](https://cve.now/CVE-2025-2291.md): PgBouncer default auth\_query does not take Postgres password expiry into account (CVSS 8.1, PgBouncer)
- [CVE-2025-32872](https://cve.now/CVE-2025-32872.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32871](https://cve.now/CVE-2025-32871.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32870](https://cve.now/CVE-2025-32870.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32869](https://cve.now/CVE-2025-32869.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32868](https://cve.now/CVE-2025-32868.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32867](https://cve.now/CVE-2025-32867.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32866](https://cve.now/CVE-2025-32866.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32865](https://cve.now/CVE-2025-32865.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32864](https://cve.now/CVE-2025-32864.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32863](https://cve.now/CVE-2025-32863.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32862](https://cve.now/CVE-2025-32862.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32861](https://cve.now/CVE-2025-32861.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32860](https://cve.now/CVE-2025-32860.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32859](https://cve.now/CVE-2025-32859.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32858](https://cve.now/CVE-2025-32858.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32857](https://cve.now/CVE-2025-32857.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32856](https://cve.now/CVE-2025-32856.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32855](https://cve.now/CVE-2025-32855.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32854](https://cve.now/CVE-2025-32854.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32853](https://cve.now/CVE-2025-32853.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32852](https://cve.now/CVE-2025-32852.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32851](https://cve.now/CVE-2025-32851.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32850](https://cve.now/CVE-2025-32850.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32849](https://cve.now/CVE-2025-32849.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32848](https://cve.now/CVE-2025-32848.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32847](https://cve.now/CVE-2025-32847.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32846](https://cve.now/CVE-2025-32846.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32845](https://cve.now/CVE-2025-32845.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32844](https://cve.now/CVE-2025-32844.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32843](https://cve.now/CVE-2025-32843.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32842](https://cve.now/CVE-2025-32842.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32841](https://cve.now/CVE-2025-32841.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32840](https://cve.now/CVE-2025-32840.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32839](https://cve.now/CVE-2025-32839.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32838](https://cve.now/CVE-2025-32838.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32837](https://cve.now/CVE-2025-32837.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32836](https://cve.now/CVE-2025-32836.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32835](https://cve.now/CVE-2025-32835.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32834](https://cve.now/CVE-2025-32834.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32833](https://cve.now/CVE-2025-32833.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32832](https://cve.now/CVE-2025-32832.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32831](https://cve.now/CVE-2025-32831.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32830](https://cve.now/CVE-2025-32830.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32829](https://cve.now/CVE-2025-32829.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32828](https://cve.now/CVE-2025-32828.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32827](https://cve.now/CVE-2025-32827.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32826](https://cve.now/CVE-2025-32826.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32825](https://cve.now/CVE-2025-32825.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32824](https://cve.now/CVE-2025-32824.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32823](https://cve.now/CVE-2025-32823.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32822](https://cve.now/CVE-2025-32822.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-32475](https://cve.now/CVE-2025-32475.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-31353](https://cve.now/CVE-2025-31353.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-31352](https://cve.now/CVE-2025-31352.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-31351](https://cve.now/CVE-2025-31351.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-31350](https://cve.now/CVE-2025-31350.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-31349](https://cve.now/CVE-2025-31349.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-31343](https://cve.now/CVE-2025-31343.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-30032](https://cve.now/CVE-2025-30032.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-30031](https://cve.now/CVE-2025-30031.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-30030](https://cve.now/CVE-2025-30030.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-30003](https://cve.now/CVE-2025-30003.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-30002](https://cve.now/CVE-2025-30002.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-29905](https://cve.now/CVE-2025-29905.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 8.8, Siemens TeleControl Server Basic)
- [CVE-2025-27540](https://cve.now/CVE-2025-27540.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 9.8, Siemens TeleControl Server Basic)
- [CVE-2025-27539](https://cve.now/CVE-2025-27539.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 9.8, Siemens TeleControl Server Basic)
- [CVE-2025-27495](https://cve.now/CVE-2025-27495.md): A vulnerability has been identified in TeleControl Server Basic (All versions \< V3.1.2.2). (CVSS 9.8, Siemens TeleControl Server Basic)
- [CVE-2025-39472](https://cve.now/CVE-2025-39472.md): WordPress WooCommerce Social Login plugin \< 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpweb WooCommerce Social Login)
- [CVE-2025-22872](https://cve.now/CVE-2025-22872.md): Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net (CVSS 6.5, golang.org/x/net/html · golang.org/x/net)
- [CVE-2025-3739](https://cve.now/CVE-2025-3739.md): Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040 (CVSS 5.9, Drupal 8 Google Optimize Hide Page · drupal/d8\_google\_optim…)
- [CVE-2025-3738](https://cve.now/CVE-2025-3738.md): Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039 (CVSS 5.9, Drupal Google Optimize · drupal/google\_optimize)
- [CVE-2025-3737](https://cve.now/CVE-2025-3737.md): Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038 (CVSS 5.9, Drupal Google Maps: Store Locator · drupal/gmap\_store\_locat…)
- [CVE-2025-3736](https://cve.now/CVE-2025-3736.md): Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037 (CVSS 5.9, Drupal Simple GTM · drupal/simple\_gtm)
- [CVE-2025-3735](https://cve.now/CVE-2025-3735.md): Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036 (CVSS 5.9, Drupal Panelizer · drupal/panelizer)
- [CVE-2025-3734](https://cve.now/CVE-2025-3734.md): Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035 (CVSS 5.9, Drupal Stage File Proxy · drupal/stage\_file\_proxy)
- [CVE-2025-3733](https://cve.now/CVE-2025-3733.md): baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034 (CVSS 6.5, Drupal baguetteBox.js · drupal/baguettebox)
- [CVE-2024-22314](https://cve.now/CVE-2024-22314.md): IBM Storage Defender - Resiliency Service information disclosure (CVSS 5.9, IBM Storage Defender - Resiliency Service)
- [CVE-2025-20236](https://cve.now/CVE-2025-20236.md): Cisco Webex App Client-Side Remote Code Execution Vulnerability (CVSS 8.8, Cisco Webex Teams)
- [CVE-2025-2564](https://cve.now/CVE-2025-2564.md): Unauthorized View Access to Archived Channel Member Info (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-20150](https://cve.now/CVE-2025-20150.md): Cisco Nexus Dashboard Username Enumeration Vulnerability (CVSS 5.3, Cisco Nexus Dashboard)
- [CVE-2025-20178](https://cve.now/CVE-2025-20178.md): Cisco Secure Network Analytics Privilege Escalation Vulnerability (CVSS 6.0, Cisco Secure Network Analytics)
- [CVE-2024-56736](https://cve.now/CVE-2024-56736.md): Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss (CVSS 6.5, Apache Software Foundation Apache HertzBeat)
- [CVE-2025-3697](https://cve.now/CVE-2025-3697.md): SourceCodester Web-based Pharmacy Product Management System edit-product.php sql injection (CVSS 5.3, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-3696](https://cve.now/CVE-2025-3696.md): SourceCodester Web-based Pharmacy Product Management System search\_stock. php sql injection (CVSS 5.3, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-3694](https://cve.now/CVE-2025-3694.md): SourceCodester Web-based Pharmacy Product Management System Login sql injection (CVSS 6.9, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-23138](https://cve.now/CVE-2025-23138.md): watch\_queue: fix pipe accounting mismatch (no CVSS, Linux)
- [CVE-2025-23137](https://cve.now/CVE-2025-23137.md): cpufreq/amd-pstate: Add missing NULL ptr check in amd\_pstate\_update (no CVSS, Linux)
- [CVE-2025-23136](https://cve.now/CVE-2025-23136.md): thermal: int340x: Add NULL check for adev (CVSS 5.5, Linux)
- [CVE-2025-23135](https://cve.now/CVE-2025-23135.md): RISC-V: KVM: Teardown riscv specific bits after kvm\_exit (no CVSS, Linux)
- [CVE-2025-23134](https://cve.now/CVE-2025-23134.md): ALSA: timer: Don't take register\_mutex with copy\_from/to\_user() (CVSS 5.5, Linux)
- [CVE-2025-23133](https://cve.now/CVE-2025-23133.md): wifi: ath11k: update channel list in reg notifier instead reg worker (CVSS 8.8, Linux)
- [CVE-2025-23132](https://cve.now/CVE-2025-23132.md): f2fs: quota: fix to avoid warning in dquot\_writeback\_dquots() (CVSS 7.0, Linux)
- [CVE-2025-23131](https://cve.now/CVE-2025-23131.md): dlm: prevent NPD when writing a positive value to event\_done (no CVSS, Linux)
- [CVE-2025-23130](https://cve.now/CVE-2025-23130.md): f2fs: fix to avoid panic once fallocation fails for pinfile (no CVSS, Linux)
- [CVE-2025-23129](https://cve.now/CVE-2025-23129.md): wifi: ath11k: Clear affinity hint before calling ath11k\_pcic\_free\_irq() in error path (no CVSS, Linux)
- [CVE-2025-22128](https://cve.now/CVE-2025-22128.md): wifi: ath12k: Clear affinity hint before calling ath12k\_pci\_free\_irq() in error path (no CVSS, Linux)
- [CVE-2025-22127](https://cve.now/CVE-2025-22127.md): f2fs: fix potential deadloop in prepare\_compress\_overwrite() (no CVSS, Linux)
- [CVE-2025-22126](https://cve.now/CVE-2025-22126.md): md: fix mddev uaf while iterating all\_mddevs list (no CVSS, Linux)
- [CVE-2025-22125](https://cve.now/CVE-2025-22125.md): md/raid1,raid10: don't ignore IO flags (no CVSS, Linux)
- [CVE-2025-22124](https://cve.now/CVE-2025-22124.md): md/md-bitmap: fix wrong bitmap\_limit for clustermd when write sb (CVSS 7.8, Linux)
- [CVE-2025-22123](https://cve.now/CVE-2025-22123.md): f2fs: fix to avoid accessing uninitialized curseg (no CVSS, Linux)
- [CVE-2025-22122](https://cve.now/CVE-2025-22122.md): block: fix adding folio to bio (no CVSS, Linux)
- [CVE-2025-22121](https://cve.now/CVE-2025-22121.md): ext4: fix out-of-bound read in ext4\_xattr\_inode\_dec\_ref\_all() (CVSS 8.4, Linux)
- [CVE-2025-22120](https://cve.now/CVE-2025-22120.md): ext4: goto right label 'out\_mmap\_sem' in ext4\_setattr() (no CVSS, Linux)
- [CVE-2025-22119](https://cve.now/CVE-2025-22119.md): wifi: cfg80211: init wiphy\_work before allocating rfkill fails (no CVSS, Linux)
- [CVE-2025-22118](https://cve.now/CVE-2025-22118.md): ice: validate queue quanta parameters to prevent OOB access (CVSS 8.8, Linux)
- [CVE-2025-22117](https://cve.now/CVE-2025-22117.md): ice: fix using untrusted value of pkt\_len in ice\_vc\_fdir\_parse\_raw() (CVSS 8.7, Linux)
- [CVE-2025-22116](https://cve.now/CVE-2025-22116.md): idpf: check error for register\_netdev() on init (no CVSS, Linux)
- [CVE-2025-22115](https://cve.now/CVE-2025-22115.md): btrfs: fix block group refcount race in btrfs\_create\_pending\_block\_groups() (CVSS 7.8, Linux)
- [CVE-2025-22114](https://cve.now/CVE-2025-22114.md): btrfs: don't clobber ret in btrfs\_validate\_super() (CVSS 7.8, Linux)
- [CVE-2025-22113](https://cve.now/CVE-2025-22113.md): ext4: avoid journaling sb update on error if journal is destroying (no CVSS, Linux)
- [CVE-2025-22112](https://cve.now/CVE-2025-22112.md): eth: bnxt: fix out-of-range access of vnic\_info array (no CVSS, Linux)
- [CVE-2025-22111](https://cve.now/CVE-2025-22111.md): net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (no CVSS, Linux)
- [CVE-2025-22110](https://cve.now/CVE-2025-22110.md): netfilter: nfnetlink\_queue: Initialize ctx to avoid memory allocation error (CVSS 9.8, Linux)
- [CVE-2025-22109](https://cve.now/CVE-2025-22109.md): ax25: Remove broken autobind (CVSS 7.8, Linux)
- [CVE-2025-22108](https://cve.now/CVE-2025-22108.md): bnxt\_en: Mask the bd\_cnt field in the TX BD properly (CVSS 8.6, Linux)
- [CVE-2025-22107](https://cve.now/CVE-2025-22107.md): net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105\_table\_delete\_entry() (no CVSS, Linux)
- [CVE-2025-22106](https://cve.now/CVE-2025-22106.md): vmxnet3: unregister xdp rxq info in the reset path (no CVSS, Linux)
- [CVE-2025-22105](https://cve.now/CVE-2025-22105.md): bonding: check xdp prog when set bond mode (no CVSS, Linux)
- [CVE-2025-22104](https://cve.now/CVE-2025-22104.md): ibmvnic: Use kernel helpers for hex dumps (no CVSS, Linux)
- [CVE-2025-22103](https://cve.now/CVE-2025-22103.md): net: fix NULL pointer dereference in l3mdev\_l3\_rcv (no CVSS, Linux)
- [CVE-2025-22102](https://cve.now/CVE-2025-22102.md): Bluetooth: btnxpuart: Fix kernel panic during FW release (CVSS 7.8, Linux)
- [CVE-2025-22101](https://cve.now/CVE-2025-22101.md): net: libwx: fix Tx L4 checksum (no CVSS, Linux)
- [CVE-2025-22100](https://cve.now/CVE-2025-22100.md): drm/panthor: Fix race condition when gathering fdinfo group samples (CVSS 7.8, Linux)
- [CVE-2025-22099](https://cve.now/CVE-2025-22099.md): drm: xlnx: zynqmp\_dpsub: Add NULL check in zynqmp\_audio\_init (no CVSS, Linux)
- [CVE-2025-22098](https://cve.now/CVE-2025-22098.md): drm: zynqmp\_dp: Fix a deadlock in zynqmp\_dp\_ignore\_hpd\_set() (no CVSS, Linux)
- [CVE-2025-22097](https://cve.now/CVE-2025-22097.md): drm/vkms: Fix use after free and double free on init error (CVSS 7.8, Linux)
- [CVE-2025-22096](https://cve.now/CVE-2025-22096.md): drm/msm/gem: Fix error code msm\_parse\_deps() (no CVSS, Linux)
- [CVE-2025-22095](https://cve.now/CVE-2025-22095.md): PCI: brcmstb: Fix error path after a call to regulator\_bulk\_get() (no CVSS, Linux)
- [CVE-2025-22094](https://cve.now/CVE-2025-22094.md): powerpc/perf: Fix ref-counting on the PMU 'vpa\_pmu' (CVSS 7.3, Linux)
- [CVE-2025-22093](https://cve.now/CVE-2025-22093.md): drm/amd/display: avoid NPD when ASIC does not support DMUB (no CVSS, Linux)
- [CVE-2025-22092](https://cve.now/CVE-2025-22092.md): PCI: Fix NULL dereference in SR-IOV VF creation error path (no CVSS, Linux)
- [CVE-2025-22091](https://cve.now/CVE-2025-22091.md): RDMA/mlx5: Fix page\_size variable overflow (no CVSS, Linux)
- [CVE-2025-22090](https://cve.now/CVE-2025-22090.md): x86/mm/pat: Fix VM\_PAT handling when fork() fails in copy\_page\_range() (CVSS 7.3, Linux)
- [CVE-2025-22089](https://cve.now/CVE-2025-22089.md): RDMA/core: Don't expose hw\_counters outside of init net namespace (CVSS 7.8, Linux)
- [CVE-2025-22088](https://cve.now/CVE-2025-22088.md): RDMA/erdma: Prevent use-after-free in erdma\_accept\_newconn() (CVSS 9.8, Linux)
- [CVE-2025-22087](https://cve.now/CVE-2025-22087.md): bpf: Fix array bounds error with may\_goto (CVSS 7.8, Linux)
- [CVE-2025-22086](https://cve.now/CVE-2025-22086.md): RDMA/mlx5: Fix mlx5\_poll\_one() cur\_qp update flow (CVSS 8.8, Linux)
- [CVE-2025-22085](https://cve.now/CVE-2025-22085.md): RDMA/core: Fix use-after-free when rename device name (CVSS 7.8, Linux)
- [CVE-2025-22084](https://cve.now/CVE-2025-22084.md): w1: fix NULL pointer dereference in probe (no CVSS, Linux)
- [CVE-2025-22083](https://cve.now/CVE-2025-22083.md): vhost-scsi: Fix handling of multiple calls to vhost\_scsi\_set\_endpoint (CVSS 7.8, Linux)
- [CVE-2025-22082](https://cve.now/CVE-2025-22082.md): iio: backend: make sure to NULL terminate stack buffer (no CVSS, Linux)
- [CVE-2025-22081](https://cve.now/CVE-2025-22081.md): fs/ntfs3: Fix a couple integer overflows on 32bit systems (CVSS 7.8, Linux)
- [CVE-2025-22080](https://cve.now/CVE-2025-22080.md): fs/ntfs3: Prevent integer overflow in hdr\_first\_de() (CVSS 8.4, Linux)
- [CVE-2025-22079](https://cve.now/CVE-2025-22079.md): ocfs2: validate l\_tree\_depth to avoid out-of-bounds access (CVSS 7.8, Linux)
- [CVE-2025-22078](https://cve.now/CVE-2025-22078.md): staging: vchiq\_arm: Fix possible NPR of keep-alive thread (no CVSS, Linux)
- [CVE-2025-22077](https://cve.now/CVE-2025-22077.md): Revert "smb: client: fix TCP timers deadlock after rmmod" (CVSS 9.8, Linux)
- [CVE-2025-22076](https://cve.now/CVE-2025-22076.md): exfat: fix missing shutdown check (no CVSS, Linux)
- [CVE-2025-22075](https://cve.now/CVE-2025-22075.md): rtnetlink: Allocate vfinfo size for VF GUIDs when supported (no CVSS, Linux)
- [CVE-2025-22074](https://cve.now/CVE-2025-22074.md): ksmbd: fix r\_count dec/increment mismatch (CVSS 8.8, Linux)
- [CVE-2025-22073](https://cve.now/CVE-2025-22073.md): spufs: fix a leak on spufs\_new\_file() failure (no CVSS, Linux)
- [CVE-2025-22072](https://cve.now/CVE-2025-22072.md): spufs: fix gang directory lifetimes (CVSS 7.8, Linux)
- [CVE-2025-22071](https://cve.now/CVE-2025-22071.md): spufs: fix a leak in spufs\_create\_context() (no CVSS, Linux)
- [CVE-2025-22070](https://cve.now/CVE-2025-22070.md): fs/9p: fix NULL pointer dereference on mkdir (CVSS 5.5, Linux)
- [CVE-2025-22069](https://cve.now/CVE-2025-22069.md): riscv: fgraph: Fix stack layout to match \_\_arch\_ftrace\_regs argument of ftrace\_return\_to\_handler (CVSS 7.8, Linux)
- [CVE-2025-22068](https://cve.now/CVE-2025-22068.md): ublk: make sure ubq-\>canceling is set when queue is frozen (CVSS 7.8, Linux)
- [CVE-2025-22067](https://cve.now/CVE-2025-22067.md): spi: cadence: Fix out-of-bounds array access in cdns\_mrvl\_xspi\_setup\_clock() (CVSS 7.8, Linux)
- [CVE-2025-22066](https://cve.now/CVE-2025-22066.md): ASoC: imx-card: Add NULL check in imx\_card\_probe() (CVSS 5.5, Linux)
- [CVE-2025-22065](https://cve.now/CVE-2025-22065.md): idpf: fix adapter NULL pointer dereference on reboot (CVSS 5.5, Linux)
- [CVE-2025-22064](https://cve.now/CVE-2025-22064.md): netfilter: nf\_tables: don't unregister hook when table is dormant (no CVSS, Linux)
- [CVE-2025-22063](https://cve.now/CVE-2025-22063.md): netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVSS 5.5, Linux)
- [CVE-2025-22062](https://cve.now/CVE-2025-22062.md): sctp: add mutual exclusion in proc\_sctp\_do\_udp\_port() (CVSS 7.8, Linux)
- [CVE-2025-22061](https://cve.now/CVE-2025-22061.md): net: airoha: Fix qid report in airoha\_tc\_get\_htb\_get\_leaf\_queue() (CVSS 7.8, Linux)
- [CVE-2025-22060](https://cve.now/CVE-2025-22060.md): net: mvpp2: Prevent parser TCAM memory corruption (no CVSS, Linux)
- [CVE-2025-22059](https://cve.now/CVE-2025-22059.md): udp: Fix multiple wraparounds of sk-\>sk\_rmem\_alloc. (CVSS 7.5, Linux)
- [CVE-2025-22058](https://cve.now/CVE-2025-22058.md): udp: Fix memory accounting leak. (no CVSS, Linux)
- [CVE-2025-22057](https://cve.now/CVE-2025-22057.md): net: decrease cached dst counters in dst\_release (CVSS 7.8, Linux)
- [CVE-2025-22056](https://cve.now/CVE-2025-22056.md): netfilter: nft\_tunnel: fix geneve\_opt type confusion addition (CVSS 7.8, Linux)
- [CVE-2025-22055](https://cve.now/CVE-2025-22055.md): net: fix geneve\_opt length integer overflow (CVSS 7.1, Linux)
- [CVE-2025-22054](https://cve.now/CVE-2025-22054.md): arcnet: Add NULL check in com20020pci\_probe() (CVSS 5.5, Linux)
- [CVE-2025-22053](https://cve.now/CVE-2025-22053.md): net: ibmveth: make veth\_pool\_store stop hanging (no CVSS, Linux)
- [CVE-2025-22052](https://cve.now/CVE-2025-22052.md): staging: gpib: Fix Oops after disconnect in ni\_usb (CVSS 5.5, Linux)
- [CVE-2025-22051](https://cve.now/CVE-2025-22051.md): staging: gpib: Fix Oops after disconnect in agilent usb (CVSS 5.5, Linux)
- [CVE-2025-22050](https://cve.now/CVE-2025-22050.md): usbnet:fix NPE during rx\_complete (no CVSS, Linux)
- [CVE-2025-22049](https://cve.now/CVE-2025-22049.md): LoongArch: Increase ARCH\_DMA\_MINALIGN up to 16 (CVSS 7.8, Linux)
- [CVE-2025-22048](https://cve.now/CVE-2025-22048.md): LoongArch: BPF: Don't override subprog's return value (CVSS 7.8, Linux)
- [CVE-2025-22047](https://cve.now/CVE-2025-22047.md): x86/microcode/AMD: Fix \_\_apply\_microcode\_amd()'s return value (CVSS 7.8, Linux)
- [CVE-2025-22046](https://cve.now/CVE-2025-22046.md): uprobes/x86: Harden uretprobe syscall trampoline check (no CVSS, Linux)
- [CVE-2025-22045](https://cve.now/CVE-2025-22045.md): x86/mm: Fix flush\_tlb\_range() when used for zapping normal PMDs (CVSS 7.8, Linux)
- [CVE-2025-22044](https://cve.now/CVE-2025-22044.md): acpi: nfit: fix narrowing conversion in acpi\_nfit\_ctl (CVSS 7.1, Linux)
- [CVE-2025-22043](https://cve.now/CVE-2025-22043.md): ksmbd: add bounds check for durable handle context (CVSS 8.1, Linux)
- [CVE-2025-22042](https://cve.now/CVE-2025-22042.md): ksmbd: add bounds check for create lease context (CVSS 8.1, Linux)
- [CVE-2025-22041](https://cve.now/CVE-2025-22041.md): ksmbd: fix use-after-free in ksmbd\_sessions\_deregister() (CVSS 8.8, Linux)
- [CVE-2025-22040](https://cve.now/CVE-2025-22040.md): ksmbd: fix session use-after-free in multichannel connection (CVSS 8.8, Linux)
- [CVE-2025-22039](https://cve.now/CVE-2025-22039.md): ksmbd: fix overflow in dacloffset bounds check (CVSS 8.8, Linux)
- [CVE-2025-22038](https://cve.now/CVE-2025-22038.md): ksmbd: validate zero num\_subauth before sub\_auth is accessed (CVSS 8.3, Linux)
- [CVE-2025-22037](https://cve.now/CVE-2025-22037.md): ksmbd: fix null pointer dereference in alloc\_preauth\_hash() (CVSS 7.5, Linux)
- [CVE-2025-22036](https://cve.now/CVE-2025-22036.md): exfat: fix random stack corruption after get\_block (CVSS 7.8, Linux)
- [CVE-2025-22035](https://cve.now/CVE-2025-22035.md): tracing: Fix use-after-free in print\_graph\_function\_flags during tracer switching (CVSS 7.8, Linux)
- [CVE-2025-22034](https://cve.now/CVE-2025-22034.md): mm/gup: reject FOLL\_SPLIT\_PMD with hugetlb VMAs (CVSS 7.8, Linux)
- [CVE-2025-22033](https://cve.now/CVE-2025-22033.md): arm64: Don't call NULL in do\_compat\_alignment\_fixup() (CVSS 5.5, Linux)
- [CVE-2025-22032](https://cve.now/CVE-2025-22032.md): wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (CVSS 5.5, Linux)
- [CVE-2025-22031](https://cve.now/CVE-2025-22031.md): PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion (CVSS 5.5, Linux)
- [CVE-2025-22030](https://cve.now/CVE-2025-22030.md): mm: zswap: fix crypto\_free\_acomp() deadlock in zswap\_cpu\_comp\_dead() (no CVSS, Linux)
- [CVE-2025-22028](https://cve.now/CVE-2025-22028.md): media: vimc: skip .s\_stream() for stopped entities (no CVSS, Linux)
- [CVE-2025-22027](https://cve.now/CVE-2025-22027.md): media: streamzap: fix race between device disconnection and urb callback (CVSS 4.7, Linux)
- [CVE-2025-22026](https://cve.now/CVE-2025-22026.md): nfsd: don't ignore the return code of svc\_proc\_register() (no CVSS, Linux)
- [CVE-2025-22025](https://cve.now/CVE-2025-22025.md): nfsd: put dl\_stid if fail to queue dl\_recall (CVSS 7.5, Linux)
- [CVE-2025-22024](https://cve.now/CVE-2025-22024.md): nfsd: fix management of listener transports (CVSS 5.5, Linux)
- [CVE-2024-58097](https://cve.now/CVE-2024-58097.md): wifi: ath11k: fix RCU stall while reaping monitor destination ring (CVSS 5.5, Linux)
- [CVE-2024-58096](https://cve.now/CVE-2024-58096.md): wifi: ath11k: add srng-\>lock for ath11k\_hal\_srng\_ in monitor mode (CVSS 8.8, Linux)
- [CVE-2024-58095](https://cve.now/CVE-2024-58095.md): jfs: add check read-only before txBeginAnon() call (no CVSS, Linux)
- [CVE-2024-58094](https://cve.now/CVE-2024-58094.md): jfs: add check read-only before truncation in jfs\_truncate\_nolock() (CVSS 7.8, Linux)
- [CVE-2024-58093](https://cve.now/CVE-2024-58093.md): PCI/ASPM: Fix link state exit during switch upstream function removal (no CVSS, Linux)
- [CVE-2023-53034](https://cve.now/CVE-2023-53034.md): ntb\_hw\_switchtec: Fix shift-out-of-bounds in switchtec\_ntb\_mw\_set\_trans (CVSS 7.1, Linux)
- [CVE-2025-3693](https://cve.now/CVE-2025-3693.md): Tenda W12 httpd cgiWifiRadioSet stack-based overflow (CVSS 8.7, Tenda W12)
- [CVE-2025-3692](https://cve.now/CVE-2025-3692.md): SourceCodester Online Eyewear Shop Master.php cross site scripting (CVSS 4.8, SourceCodester Online Eyewear Shop)
- [CVE-2025-3691](https://cve.now/CVE-2025-3691.md): mirweiye Seven Bears Library CMS Add Link server-side request forgery (CVSS 5.1, mirweiye Seven Bears Library CMS)
- [CVE-2025-3690](https://cve.now/CVE-2025-3690.md): PHPGurukul Men Salon Management System edit-services.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-39512](https://cve.now/CVE-2025-39512.md): WordPress Bulk Term Editor plugin \<= 1.1.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Yuya Hoshino Bulk Term Editor)
- [CVE-2025-39513](https://cve.now/CVE-2025-39513.md): WordPress ActiveDEMAND plugin \<= 0.2.46 - Broken Access Control vulnerability (CVSS 5.3, ActiveDEMAND Online Agency Marketing Automation ActiveDEMAND)
- [CVE-2025-39514](https://cve.now/CVE-2025-39514.md): WordPress Asgaros Forum plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Asgaros Forum)
- [CVE-2025-39515](https://cve.now/CVE-2025-39515.md): WordPress Attendance Manager plugin \<= 0.6.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, tnomi Attendance Manager)
- [CVE-2025-39516](https://cve.now/CVE-2025-39516.md): WordPress Author WIP Progress Bar plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Alan Petersen Author WIP Progress Bar)
- [CVE-2025-39517](https://cve.now/CVE-2025-39517.md): WordPress Basic Interactive World Map plugin \<= 2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, WP Map Plugins Basic Interactive World Map)
- [CVE-2025-39518](https://cve.now/CVE-2025-39518.md): WordPress BMA Lite plugin \<= 1.4.2 - SQL Injection vulnerability (CVSS 7.6, RedefiningTheWeb BMA Lite)
- [CVE-2025-39520](https://cve.now/CVE-2025-39520.md): WordPress Checkout Files Upload for WooCommerce plugin \<= 2.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Wham Checkout Files Upload for WooCommerce)
- [CVE-2025-39522](https://cve.now/CVE-2025-39522.md): WordPress Dynamic Post plugin \<= 5.03 - Settings Change vulnerability (CVSS 5.4, Service2Client Dynamic Post)
- [CVE-2025-39524](https://cve.now/CVE-2025-39524.md): WordPress Html5 Audio Player plugin \<= 2.2.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, bPlugins Html5 Audio Player)
- [CVE-2025-39525](https://cve.now/CVE-2025-39525.md): WordPress Logo Carousel Slider plugin \<= 2.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpWax Logo Carousel Slider)
- [CVE-2025-39528](https://cve.now/CVE-2025-39528.md): WordPress Rescue Shortcodes plugin \<= 3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rescue Themes Rescue Shortcodes)
- [CVE-2025-39529](https://cve.now/CVE-2025-39529.md): WordPress Scriptless Social Sharing plugin \<= 3.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Robin Cornett Scriptless Social Sharing)
- [CVE-2025-39530](https://cve.now/CVE-2025-39530.md): WordPress Site Search 360 plugin \<= 2.1.8 - Cross Site Request Forgery (CSRF) to stored XSS vulnerability (CVSS 7.1, dsky Site Search)
- [CVE-2025-39531](https://cve.now/CVE-2025-39531.md): WordPress Slazzer Background Changer plugin \<= 3.14 - Broken Access Control Vulnerability (CVSS 5.3, slazzercom Slazzer Background Changer)
- [CVE-2025-39538](https://cve.now/CVE-2025-39538.md): WordPress WP-Advanced-Search plugin \<= 3.3.9.4 - Arbitrary File Upload Vulnerability (CVSS 6.6, Mathieu Chartier WP-Advanced-Search)
- [CVE-2025-39540](https://cve.now/CVE-2025-39540.md): WordPress WP Flipclock plugin \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rhys Wynne WP Flipclock)
- [CVE-2025-39543](https://cve.now/CVE-2025-39543.md): WordPress Royal Elementor Addons plugin \<= 1.3.977 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Royal Royal Elementor Addons)
- [CVE-2025-39544](https://cve.now/CVE-2025-39544.md): WordPress WP Tools plugin \<= 5.18 - CSRF to Arbitrary File Deletion vulnerability (CVSS 7.4, sminozzi WP Tools)
- [CVE-2025-39545](https://cve.now/CVE-2025-39545.md): WordPress REST API Authentication plugin \<= 3.6.3 - Settings Change Vulnerability (CVSS 5.4, miniOrange WordPress REST API Authentication)
- [CVE-2025-39546](https://cve.now/CVE-2025-39546.md): WordPress ElementsReady Addons for Elementor plugin \<= 6.6.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2025-39547](https://cve.now/CVE-2025-39547.md): WordPress Internal Link Optimiser plugin \<= 5.1.3 - CSRF to XSS vulnerability (CVSS 7.1, Toast Plugins Internal Link Optimiser)
- [CVE-2025-39548](https://cve.now/CVE-2025-39548.md): WordPress Right Click Disable OR Ban plugin \<= 1.1.17 - CSRF to Stored XSS vulnerability (CVSS 7.1, A WP Life Right Click Disable OR Ban)
- [CVE-2025-39549](https://cve.now/CVE-2025-39549.md): WordPress Most And Least Read Posts Widget plugin \<= 2.5.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, whiletrue Most And Least Read Posts Widget)
- [CVE-2025-39552](https://cve.now/CVE-2025-39552.md): WordPress Zephyr Project Manager plugin \<= 3.3.200 - Broken Access Control Vulnerability (CVSS 5.4, Dylan James Zephyr Project Manager)
- [CVE-2025-39555](https://cve.now/CVE-2025-39555.md): WordPress Church Admin plugin \<= 5.0.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, andy\_moyle Church Admin)
- [CVE-2025-39556](https://cve.now/CVE-2025-39556.md): WordPress Mediavine Control Panel plugin \<= 2.10.6 - Sensitive Data Exposure vulnerability (CVSS 5.3, Mediavine Control Panel)
- [CVE-2025-39557](https://cve.now/CVE-2025-39557.md): WordPress Kadence WooCommerce Email Designer plugin \<= 1.5.14 - Arbitrary File Upload vulnerability (CVSS 9.1, StellarWP Kadence WooCommerce Email Designer)
- [CVE-2025-39560](https://cve.now/CVE-2025-39560.md): WordPress Live Forms plugin \<= 4.8.4 - Broken Access Control vulnerability (CVSS 5.4, Shahjada Live Forms)
- [CVE-2025-39563](https://cve.now/CVE-2025-39563.md): WordPress Conditional Payments for WooCommerce plugin \<= 3.3.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, WP Trio Conditional Payments for WooCommerce)
- [CVE-2025-39564](https://cve.now/CVE-2025-39564.md): WordPress Conditional Shipping for WooCommerce plugin \<= 3.4.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, WP Trio Conditional Shipping for WooCommerce)
- [CVE-2025-39565](https://cve.now/CVE-2025-39565.md): WordPress MelaPress Login Security plugin \<= 2.1.0 - PHP Object Injection Vulnerability (CVSS 6.6, MelaPress Login Security)
- [CVE-2025-39566](https://cve.now/CVE-2025-39566.md): WordPress Hostel plugin \<= 1.1.5.6 - SQL Injection Vulnerability (CVSS 7.6, Bob Hostel)
- [CVE-2025-39570](https://cve.now/CVE-2025-39570.md): WordPress WPCOM Member plugin \<= 1.7.7 - Local File Inclusion Vulnerability (CVSS 8.8, Lomu WPCOM Member)
- [CVE-2025-39571](https://cve.now/CVE-2025-39571.md): WordPress WowStore plugin \<= 4.2.4 - Broken Access Control Vulnerability (CVSS 4.3, WPXPO WowStore)
- [CVE-2025-39572](https://cve.now/CVE-2025-39572.md): WordPress Checkout for PayPal plugin \<= 1.0.38 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Noor Alam Checkout for PayPal)
- [CVE-2025-39573](https://cve.now/CVE-2025-39573.md): WordPress WP Posts Carousel plugin \<= 1.3.10 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, teastudio.pl WP Posts Carousel)
- [CVE-2025-39574](https://cve.now/CVE-2025-39574.md): WordPress Uix Shortcodes plugin \<= 2.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, UIUX Lab Uix Shortcodes)
- [CVE-2025-39575](https://cve.now/CVE-2025-39575.md): WordPress WPCasa plugin \<= 1.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPSight WPCasa)
- [CVE-2025-39576](https://cve.now/CVE-2025-39576.md): WordPress WPAdverts plugin \<= 2.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Greg Winiarski WPAdverts)
- [CVE-2025-39577](https://cve.now/CVE-2025-39577.md): WordPress PropertyHive plugin \<= 2.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Property Hive PropertyHive)
- [CVE-2025-39578](https://cve.now/CVE-2025-39578.md): WordPress Responsive Blocks plugin \<= 2.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CyberChimps Responsive Blocks)
- [CVE-2025-39579](https://cve.now/CVE-2025-39579.md): WordPress Membership For WooCommerce plugin \<= 2.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Swings Membership For WooCommerce)
- [CVE-2025-39581](https://cve.now/CVE-2025-39581.md): WordPress Themify Shortcodes plugin \<= 2.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, themifyme Themify Shortcodes)
- [CVE-2025-39582](https://cve.now/CVE-2025-39582.md): WordPress WP Data Access plugin \<= 5.5.36 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Passionate Programmer Peter WP Data Access)
- [CVE-2025-39584](https://cve.now/CVE-2025-39584.md): WordPress Eventin plugin \<= 4.0.25 - Local File Inclusion Vulnerability (CVSS 7.5, Arraytics Eventin)
- [CVE-2025-39585](https://cve.now/CVE-2025-39585.md): WordPress Travelfic Toolkit plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Themefic Travelfic Toolkit)
- [CVE-2025-39589](https://cve.now/CVE-2025-39589.md): WordPress Essential Addons for Elementor plugin \<= 6.1.9 - Sensitive Data Exposure Vulnerability (CVSS 4.3, WPDeveloper Essential Addons for Elementor)
- [CVE-2025-39590](https://cve.now/CVE-2025-39590.md): WordPress Essential Addons for Elementor plugin \<= 6.1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPDeveloper Essential Addons for Elementor)
- [CVE-2025-39591](https://cve.now/CVE-2025-39591.md): WordPress WP Subscription Forms plugin \<= 1.2.3 - Broken Access Control Vulnerability (CVSS 5.4, WP Shuffle WP Subscription Forms)
- [CVE-2025-39592](https://cve.now/CVE-2025-39592.md): WordPress Subscribe to Unlock Lite plugin \<= 1.3.0 - Local File Inclusion Vulnerability (CVSS 7.5, WP Shuffle Subscribe to Unlock Lite)
- [CVE-2025-39593](https://cve.now/CVE-2025-39593.md): WordPress Ever Accounting plugin \<= 2.1.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, EverAccounting Ever Accounting)
- [CVE-2025-39597](https://cve.now/CVE-2025-39597.md): WordPress Fast eBay Listings plugin \<= 2.12.15 - Open Redirection Vulnerability (CVSS 4.7, Arthur Yarwood Fast eBay Listings)
- [CVE-2025-39598](https://cve.now/CVE-2025-39598.md): WordPress Administrator Z plugin \<= 2025.03.28 - Directory Traversal Vulnerability (CVSS 4.9, Quý Lê 91 Administrator Z)
- [CVE-2025-39599](https://cve.now/CVE-2025-39599.md): WordPress Listdom plugin \<= 4.0.0 - Open Redirection Vulnerability (CVSS 4.7, Webilia Listdom)
- [CVE-2025-39600](https://cve.now/CVE-2025-39600.md): WordPress Integration for WooCommerce and QuickBooks plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, CRM Perks Integration for WooCommerce and QuickBooks)
- [CVE-2025-39601](https://cve.now/CVE-2025-39601.md): WordPress Custom CSS, JS & PHP plugin \<= 2.4.1 - CSRF to RCE vulnerability (CVSS 9.6, WPFactory Custom CSS, JS & PHP)
- [CVE-2025-39602](https://cve.now/CVE-2025-39602.md): WordPress WooCommerce Product Table Lite plugin \<= 3.9.5 - Broken Access Control vulnerability (CVSS 4.3, WC Product Table WooCommerce Product Table Lite)
- [CVE-2025-1983](https://cve.now/CVE-2025-1983.md): Stored Cross-Site Scripting in Ready\_ (CVSS 5.1, Symfonia Ready\_)
- [CVE-2025-1982](https://cve.now/CVE-2025-1982.md): Local File Inclusion in Ready\_ (CVSS 7.1, Symfonia Ready\_)
- [CVE-2025-1981](https://cve.now/CVE-2025-1981.md): SQL Injection in Ready\_ (CVSS 9.4, Symfonia Ready\_)
- [CVE-2025-1980](https://cve.now/CVE-2025-1980.md): Remote Code Execution via Unrestricted File Upload in Ready\_ (CVSS 7.1, Symfonia Ready\_)
- [CVE-2025-3689](https://cve.now/CVE-2025-3689.md): PHPGurukul Men Salon Management System edit-customer-detailed.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3688](https://cve.now/CVE-2025-3688.md): mirweiye Seven Bears Library CMS Background Management Page cross site scripting (CVSS 4.8, mirweiye Seven Bears Library CMS)
- [CVE-2025-3687](https://cve.now/CVE-2025-3687.md): misstt123 oasys Sticky Notes cross-site request forgery (CVSS 5.3, misstt123 oasys)
- [CVE-2025-3686](https://cve.now/CVE-2025-3686.md): misstt123 oasys show image path traversal (CVSS 5.3, misstt123 oasys)
- [CVE-2025-3685](https://cve.now/CVE-2025-3685.md): code-projects Patient Record Management System edit\_fpatient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3684](https://cve.now/CVE-2025-3684.md): Xianqi Kindergarten Management System Child Management stu\_list.php sql injection (CVSS 5.3, Xianqi Kindergarten Management System)
- [CVE-2025-3683](https://cve.now/CVE-2025-3683.md): PCMan FTP Server SIZE Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3682](https://cve.now/CVE-2025-3682.md): PCMan FTP Server PASV Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2024-58092](https://cve.now/CVE-2024-58092.md): nfsd: fix legacy client tracking initialization (no CVSS, Linux)
- [CVE-2025-30960](https://cve.now/CVE-2025-30960.md): WordPress FS Poster plugin \<= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability (CVSS 8.3, fs-code FS Poster)
- [CVE-2025-22023](https://cve.now/CVE-2025-22023.md): usb: xhci: Don't skip on Stopped - Length Invalid (no CVSS, Linux)
- [CVE-2025-22022](https://cve.now/CVE-2025-22022.md): usb: xhci: Apply the link chain quirk on NEC isoc endpoints (CVSS 7.8, Linux)
- [CVE-2025-22021](https://cve.now/CVE-2025-22021.md): netfilter: socket: Lookup orig tuple for IPv6 SNAT (CVSS 10.0, Linux)
- [CVE-2025-22020](https://cve.now/CVE-2025-22020.md): memstick: rtsx\_usb\_ms: Fix slab-use-after-free in rtsx\_usb\_ms\_drv\_remove (CVSS 7.8, Linux)
- [CVE-2025-22019](https://cve.now/CVE-2025-22019.md): bcachefs: bch2\_ioctl\_subvolume\_destroy() fixes (CVSS 7.3, Linux)
- [CVE-2025-3681](https://cve.now/CVE-2025-3681.md): PCMan FTP Server MODE Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3680](https://cve.now/CVE-2025-3680.md): PCMan FTP Server LANG Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3679](https://cve.now/CVE-2025-3679.md): PCMan FTP Server HOST Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-27936](https://cve.now/CVE-2025-27936.md): Webhook Secret Exposure via Timing attack in MSteams plugin (CVSS 5.3, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2025-31363](https://cve.now/CVE-2025-31363.md): Data exfiltration via AI plugin Jira tool (CVSS 3.0, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-3678](https://cve.now/CVE-2025-3678.md): PCMan FTP Server HELP Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2023-32197](https://cve.now/CVE-2023-32197.md): Rancher's External RoleTemplates can lead to privilege escalation (CVSS 6.6, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-22036](https://cve.now/CVE-2024-22036.md): Rancher Remote Code Execution via Cluster/Node Drivers (CVSS 9.1, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-52281](https://cve.now/CVE-2024-52281.md): Stored Cross-site Scripting vulnerability in Rancher UI (CVSS 8.9, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-3677](https://cve.now/CVE-2025-3677.md): lm-sys fastchat apply\_delta.py apply\_delta\_low\_cpu\_mem deserialization (CVSS 4.8, lm-sys fastchat)
- [CVE-2025-3104](https://cve.now/CVE-2025-3104.md): WP Staging Pro \<= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function (CVSS 5.3, WPStaging WP STAGING Pro WordPress Backup Plugin)
- [CVE-2025-3676](https://cve.now/CVE-2025-3676.md): xxyopen Novel-Plus books sql injection (CVSS 5.3, xxyopen Novel-Plus)
- [CVE-2025-27571](https://cve.now/CVE-2025-27571.md): Channel metadata visible in archived channels despite configuration setting (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-27538](https://cve.now/CVE-2025-27538.md): MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users (CVSS 2.2, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-24839](https://cve.now/CVE-2025-24839.md): Unauthorized AI bot activation via Wrangler plugin (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-3077](https://cve.now/CVE-2025-3077.md): Betheme \<= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, MuffinGroup Betheme)
- [CVE-2025-0101](https://cve.now/CVE-2025-0101.md): WAGO: Year 2038 problem (CVSS 6.5, WAGO CC100 0751-9x01 · WAGO PFC100 G1 0750-810x/xxxx-xx… +10)
- [CVE-2025-3675](https://cve.now/CVE-2025-3675.md): TOTOLINK A3700R cstecgi.cgi setL2tpServerCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3674](https://cve.now/CVE-2025-3674.md): TOTOLINK A3700R cstecgi.cgi setUrlFilterRules access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2024-10680](https://cve.now/CVE-2024-10680.md): Form Maker by 10Web \< 1.15.32 - Admin+ Stored XSS (CVSS 4.8, Form Maker by 10Web)
- [CVE-2025-3247](https://cve.now/CVE-2025-3247.md): Contact Form 7 \<= 6.0.5 - Order Replay Vulnerability (CVSS 5.3, rocklobsterinc Contact Form)
- [CVE-2025-22018](https://cve.now/CVE-2025-22018.md): atm: Fix NULL pointer dereference (CVSS 5.5, Linux)
- [CVE-2025-3668](https://cve.now/CVE-2025-3668.md): TOTOLINK A3700R cstecgi.cgi setScheduleCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3667](https://cve.now/CVE-2025-3667.md): TOTOLINK A3700R cstecgi.cgi setUPnPCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3666](https://cve.now/CVE-2025-3666.md): TOTOLINK A3700R cstecgi.cgi setDdnsCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3495](https://cve.now/CVE-2025-3495.md): COMMGR - Insufficient Randomization Authentication Bypass (CVSS 9.8, Delta Electronics COMMGR)
- [CVE-2025-3665](https://cve.now/CVE-2025-3665.md): TOTOLINK A3700R cstecgi.cgi setSmartQosCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3664](https://cve.now/CVE-2025-3664.md): TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3663](https://cve.now/CVE-2025-3663.md): TOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2025-3698](https://cve.now/CVE-2025-3698.md): Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk. (CVSS 7.5, TECNO com.transsion.carlcare)
- [CVE-2024-13452](https://cve.now/CVE-2024-13452.md): Contact Form by Supsystic \<= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action (CVSS 6.1, supsysticcom Contact Form by Supsystic)
- [CVE-2025-2314](https://cve.now/CVE-2025-2314.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2025-30100](https://cve.now/CVE-2025-30100.md): Dell Alienware Command Center 6.x, versions prior to 6.7.37.0 contain an Improper Access Control Vulnerability. (CVSS 6.7, Dell Alienware Command Center)
- [CVE-2024-40068](https://cve.now/CVE-2024-40068.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id\_generator/a (CVSS 5.9)
- [CVE-2024-40069](https://cve.now/CVE-2024-40069.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id\_generator/classes/Users.php (CVSS 5.4)
- [CVE-2024-40070](https://cve.now/CVE-2024-40070.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id\_generator/classes/User (CVSS 5.1)
- [CVE-2024-40071](https://cve.now/CVE-2024-40071.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id\_generator/classes/Syst (CVSS 9.8)
- [CVE-2024-40072](https://cve.now/CVE-2024-40072.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id\_generator/a (CVSS 9.8)
- [CVE-2024-40073](https://cve.now/CVE-2024-40073.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id\_gener (CVSS 9.8)
- [CVE-2024-40074](https://cve.now/CVE-2024-40074.md): Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id\_generator/classes/SystemSet (CVSS 4.8)
- [CVE-2024-53303](https://cve.now/CVE-2024-53303.md): A remote code execution (RCE) vulnerability in the upload\_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated a (CVSS 8.8)
- [CVE-2024-53304](https://cve.now/CVE-2024-53304.md): An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary co (CVSS 6.5)
- [CVE-2024-53305](https://cve.now/CVE-2024-53305.md): An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted sear (CVSS 7.3, whoogle-search)
- [CVE-2024-55371](https://cve.now/CVE-2024-55371.md): Wallos \<= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uplo (CVSS 9.8)
- [CVE-2024-55372](https://cve.now/CVE-2024-55372.md): Wallos \<=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by (CVSS 9.8)
- [CVE-2024-58248](https://cve.now/CVE-2024-58248.md): nopCommerce through 4.90.1 does not offer locking for order placement. (CVSS 3.5, nopCommerce)
- [CVE-2024-58249](https://cve.now/CVE-2024-58249.md): In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL. (CVSS 3.7, wxWidgets)
- [CVE-2025-26153](https://cve.now/CVE-2025-26153.md): A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. (CVSS 5.4)
- [CVE-2025-28072](https://cve.now/CVE-2025-28072.md): PHPGurukul Pre-School Enrollment System is vulnerable to Directory Traversal in manage-teachers.php. (CVSS 7.5)
- [CVE-2025-29708](https://cve.now/CVE-2025-29708.md): SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services. (CVSS 9.8)
- [CVE-2025-29709](https://cve.now/CVE-2025-29709.md): SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio. (CVSS 9.8)
- [CVE-2025-29710](https://cve.now/CVE-2025-29710.md): SourceCodester Company Website CMS 1.0 is vulnerable to Cross Site Scripting (XSS) via /dashboard/Services. (CVSS 6.1)
- [CVE-2025-43703](https://cve.now/CVE-2025-43703.md): An issue was discovered in Ankitects Anki through 25.02. (CVSS 6.1, Ankitects Anki)
- [CVE-2025-43704](https://cve.now/CVE-2025-43704.md): Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon O (CVSS 4.7, Veritas Data Insight)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.