CVEs published April 23, 2025
77 CVEs were published on April 23, 2025: 5 critical, 41 high.
- Published
- 77
- Critical
- 5
- High
- 41
- Medium
- 26
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Meon KYC solutions
- 5
- BEC Technologies Multiple Routers
- 4
- CarlinKit CPC200-CCPA
- 4
- xfig · Red Hat Enterprise Linux
- 4
- IBM InfoSphere Information Server
- 3
- Sonos Era
- 3
- Axis Communications AB AXIS Camera Station Pro
- 2
- Bdrive NetDrive
- 2
- BusyBox
- 2
- GIMP
- 2
Critical 5
- CVE-2025-32969org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2025-42605Improper Access Control Vulnerability in Meon Bidding SolutionsMeon Bidding Solutions
- CVE-2025-45427In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow vulnerability, which
- CVE-2025-45428In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack overflow vulnerabili
- CVE-2025-45429In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may le
High 41
- CVE-2025-46397Xfig: xfig: stack-overflow allows possible code execution via local input manipulationxfig · Red Hat Enterprise Linux
- CVE-2025-32818A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash tSonicWall SonicOS
- CVE-2025-3904Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045Drupal Sportsleague
- CVE-2025-3903UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044Drupal UEditor - 百度编辑器 · drupal/ueditor
- CVE-2025-2773BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution VulnerabilityBEC Technologies Multiple Routers
- CVE-2025-2769Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityBdrive NetDrive
- CVE-2025-2768Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityBdrive NetDrive
- CVE-2025-2767Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution VulnerabilityArista NG Firewall
- CVE-2025-2765CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass VulnerabilityCarlinKit CPC200-CCPA
- CVE-2025-2764CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution VulnerabilityCarlinKit CPC200-CCPA
- CVE-2025-2762CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation VulnerabilityCarlinKit CPC200-CCPA
- CVE-2025-2761GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityGIMP
- CVE-2025-2760GIMP XWD File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-1522PostHog database_schema Server-Side Request Forgery Information Disclosure VulnerabilityPostHog
- CVE-2025-1521PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure VulnerabilityPostHog
- CVE-2025-1520PostHog ClickHouse Table Functions SQL Injection Remote Code Execution VulnerabilityPostHog · @posthog/plugin-server
- CVE-2025-1050Sonos Era 300 Out-of-Bounds Write Remote Code Execution VulnerabilitySonos Era
- CVE-2025-1049Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution VulnerabilitySonos Era
- CVE-2025-1048Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution VulnerabilitySonos Era
- CVE-2025-1047Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2025-1046Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2025-1045Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2025-21605Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated clientredis
- CVE-2025-32968org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query APIxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2025-32966Dataease H2 JDBC Connection Remote Code Executiondataease
- CVE-2025-42603Information Disclosure Vulnerability in Meon KYC solutionsMeon KYC solutions
- CVE-2025-42602Improper Authentication Vulnerability in Meon KYC solutionsMeon KYC solutions
- CVE-2025-42601Captcha Bypass Vulnerability in Meon KYC solutionsMeon KYC solutions
- CVE-2025-42600Brute Force Attack Vulnerability in Meon KYC solutionsMeon KYC solutions
- CVE-2025-3530WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulationmra13 Simple Shopping Cart
- CVE-2025-3529WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parametermra13 Simple Shopping Cart
- CVE-2025-1021Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 Synology DiskStation Manager
- CVE-2025-27580NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, tiNIH BRICS
- CVE-2025-28018TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
- CVE-2025-28019TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component
- CVE-2025-28020TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
- CVE-2025-28021TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 p
- CVE-2025-28022TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
- CVE-2025-28025TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 wer
- CVE-2025-28028TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 wer
- CVE-2025-28169BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud s
Medium, low and unrated 31
- CVE-2025-25046IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2025-25045IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-22351IBM InfoSphere Information Server session fixationIBM InfoSphere Information Server
- CVE-2025-46400Xfig: fig2dev segmentation fault in read_arcobjectxfig · Red Hat Enterprise Linux
- CVE-2025-46399Xfig: transfig: fig2dev segmentation fault vulnerabilityxfig · Red Hat Enterprise Linux
- CVE-2025-46398Xfig: fig2dev stack-overflow via read_objectsxfig · Red Hat Enterprise Linux
- CVE-2025-3907Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046Drupal Search API Solr · drupal/search_api_solr
- CVE-2025-3902Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043Drupal Block Class · drupal/block_class
- CVE-2025-3901Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042Drupal Bootstrap Site Alert · drupal/bootstrap_site_alert
- CVE-2025-3900Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041Drupal Colorbox · drupal/colorbox
- CVE-2025-2772BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure VulnerabilityBEC Technologies Multiple Routers
- CVE-2025-2771BEC Technologies Multiple Routers Authentication Bypass VulnerabilityBEC Technologies Multiple Routers
- CVE-2025-2770BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure VulnerabilityBEC Technologies Multiple Routers
- CVE-2025-2763CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution VulnerabilityCarlinKit CPC200-CCPA
- CVE-2024-47829pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingpnpm
- CVE-2025-2703The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.Grafana
- CVE-2025-42604Detailed Error Response Vulnerability in Meon KYC solutionsMeon KYC solutions
- CVE-2024-10306Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requestsmod_proxy_cluster · Red Hat Enterprise Linux +1
- CVE-2025-1054UiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsUiCore Elements – Free widgets and templates for Elementor
- CVE-2025-2595Forced Browsing Vulnerability in CODESYS VisualizationCODESYS Visualization
- CVE-2025-0618A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamperTrellix FireEye EDR HX
- CVE-2025-0926Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files Axis Communications AB AXIS Camera Station Pro
- CVE-2025-1056Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using.Axis Communications AB AXIS Camera Station Pro
- CVE-2024-58251In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequeBusyBox
- CVE-2025-27581NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET moNIH BRICS
- CVE-2025-28017TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter.
- CVE-2025-29526A Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execu
- CVE-2025-43716A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9.Ivanti LANDesk Management Suite
- CVE-2025-43965In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.ImageMagick
- CVE-2025-46393In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels iImageMagick
- CVE-2025-46394In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.BusyBox