CVEs published April 29, 2025
92 CVEs were published on April 29, 2025: 8 critical, 19 high.
- Published
- 92
- Critical
- 8
- High
- 19
- Medium
- 60
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 13
- Apple iOS and iPadOS · Apple iPadOS +3
- 7
- yeswiki · yeswiki/yeswiki
- 7
- Bookgy
- 5
- Ribbon Communications Apollo
- 5
- ScriptAndTools Online-Travling-System
- 4
- Apple iOS and iPadOS · Apple iPadOS +4
- 2
- Docker Desktop
- 2
- PHPGurukul Online Nurse Hiring System
- 2
- snowflakedb libsnowflakeclient
- 2
Critical 8
- CVE-2025-46348YesWiki Vulnerable to Unauthenticated Site Backup Creation and Downloadyeswiki · yeswiki/yeswiki
- CVE-2025-0520ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code ExecutionShowDoc · showdoc/showdoc
- CVE-2025-40619Improper access control vulnerability in BookgyBookgy
- CVE-2025-40618SQL injection vulnerability in BookgyBookgy
- CVE-2025-40617SQL injection vulnerability in BookgyBookgy
- CVE-2025-4083Process isolation bypass using "javascript:" URI links in cross-origin framesMozilla Firefox · Mozilla Thunderbird
- CVE-2025-25403Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.
- CVE-2025-25962An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition func
High 19
- CVE-2025-29906Finit bundled getty can bypass /bin/logintroglobit finit
- CVE-2025-3501Org.keycloak.protocol.services: keycloak hostname verificationkeycloak · Red Hat Build of Keycloak +2
- CVE-2025-46349YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scriptingyeswiki · yeswiki/yeswiki
- CVE-2025-23181Ribbon Communications - CWE-250: Execution with Unnecessary PrivilegesRibbon Communications Apollo
- CVE-2025-23180Ribbon Communications - CWE-250: Execution with Unnecessary PrivilegesRibbon Communications Apollo
- CVE-2025-23178Ribbon Communications - CWE-923: Improper Restriction of Communication Channel to Intended EndpointsRibbon Communications Apollo
- CVE-2025-23177Ribbon Communications - CWE-427: Uncontrolled Search Path ElementRibbon Communications Apollo
- CVE-2025-4093Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-4091Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-4085Potential information leakage and privilege escalation in UITour actorMozilla Firefox · Mozilla Thunderbird
- CVE-2025-2817Privilege escalation in Thunderbird UpdaterMozilla Firefox · Mozilla Thunderbird
- CVE-2025-3891Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabledmod_auth_openidc · Red Hat Enterprise Linux
- CVE-2024-58099vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frameLinux
- CVE-2025-30194Denial of service via crafted DoH exchangePowerDNS DNSdist
- CVE-2025-24252A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24206An authentication issue was addressed with improved state management.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2024-57698An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication,
- CVE-2025-32354In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/e
- CVE-2025-45956A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated atta
Medium, low and unrated 65
- CVE-2025-46552KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation AutomationKrypto-Hashers-Community KHC-INVITATION-AUTOMATION
- CVE-2025-3910Org.keycloak.authentication: two factor authentication bypasskeycloak · Red Hat Build of Keycloak +1
- CVE-2025-46344Auth0 NextJS SDK v4 Missing Session Invalidationnextjs-auth0 · @auth0/nextjs-auth0
- CVE-2025-46550Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scriptingyeswiki · yeswiki/yeswiki
- CVE-2025-46549Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scriptingyeswiki · yeswiki/yeswiki
- CVE-2025-4078Wangshen SecGate 3600 g=log_export_file path traversalWangshen SecGate
- CVE-2025-4080PHPGurukul Online Nurse Hiring System view-request.php sql injectionPHPGurukul Online Nurse Hiring System
- CVE-2025-4079PCMan FTP Server RENAME Command buffer overflowPCMan FTP Server
- CVE-2025-4077code-projects School Billing System searchrec stack-based overflowcode-projects School Billing System
- CVE-2025-4076LB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injectionLB-LINK BL-AC3600
- CVE-2025-4075VMSMan login.php cross site scriptingVMSMan
- CVE-2025-4074PHPGurukul Curfew e-Pass Management System pass-bwdates-report.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2025-3911Exposure in Docker Desktop logs of environment variables configured for running containersDocker Desktop
- CVE-2025-4095Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profileDocker Desktop
- CVE-2025-46350Yeswiki Vulnerable to Authenticated Reflected Cross-site Scriptingyeswiki · yeswiki/yeswiki
- CVE-2025-46347YesWiki Remote Code Execution via Arbitrary PHP File Write and Executionyeswiki · yeswiki/yeswiki
- CVE-2025-4073PHPGurukul Student Record System change-password.php sql injectionPHPGurukul Student Record System
- CVE-2025-4072PHPGurukul Online Nurse Hiring System edit-nurse.php sql injectionPHPGurukul Online Nurse Hiring System
- CVE-2025-0716AngularJS improper sanitization in SVG '<image>' elementGoogle AngularJS · angular
- CVE-2025-23179Ribbon Communications - CWE-798: Use of Hard-coded CredentialsRibbon Communications Apollo
- CVE-2025-4071PHPGurukul COVID19 Testing Management System test-details.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-4070PHPGurukul Rail Pass Management System changeimage.php sql injectionPHPGurukul Rail Pass Management System
- CVE-2025-1551IBM Operational Decision Manager cross-site scriptingIBM Operational Decision Manager
- CVE-2025-40616Reflected Cross-Site Scripting (XSS) vulnerability in BookgyBookgy
- CVE-2025-40615Reflected Cross-Site Scripting (XSS) vulnerability in BookgyBookgy
- CVE-2025-46346YesWiki Vulnerable to Stored XSS in Commentsyeswiki · yeswiki/yeswiki
- CVE-2025-4069code-projects Product Management System add_item stack-based overflowcode-projects Product Management System
- CVE-2025-4068code-projects Simple Movie Ticket Booking System changeprize stack-based overflowcode-projects Simple Movie Ticket Booking System
- CVE-2025-4067ScriptAndTools Online-Travling-System viewpackage.php access controlScriptAndTools Online-Travling-System
- CVE-2025-4066ScriptAndTools Online-Travling-System addpackage.php access controlScriptAndTools Online-Travling-System
- CVE-2025-4065ScriptAndTools Online-Travling-System addadvertisement.php access controlScriptAndTools Online-Travling-System
- CVE-2025-4064ScriptAndTools Online-Travling-System viewenquiry.php access controlScriptAndTools Online-Travling-System
- CVE-2025-3301DPA Countermeasures Unavailable for Certain Cryptographic Operations on Series 2 Devicessilabs.com Series 2 SoCs and associated modules
- CVE-2025-4063code-projects Student Information Management System cancel stack-based overflowcode-projects Student Information Management System
- CVE-2025-4062code-projects Theater Seat Booking System cancel stack-based overflowcode-projects Theater Seat Booking System
- CVE-2025-4092Memory safety bugs fixed in Firefox 138 and Thunderbird 138Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-4090Leaked library paths in Thunderbird for AndroidMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4089Potential local code execution in "copy as cURL" commandMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4088Cross-site request forgery via storage access API redirectsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4087Unsafe attribute access during XPath parsingMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4086Specially crafted filename could be used to obscure download typeMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4084Potential local code execution in "copy as cURL" commandMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4082WebGL shader attribute memory corruption in Thunderbird for macOSMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4061code-projects Clothing Store Management System add_item stack-based overflowcode-projects Clothing Store Management System
- CVE-2025-4035Libsoup: cookie domain validation bypass via uppercase characters in libsoupRed Hat Enterprise Linux
- CVE-2025-4060PHPGurukul Notice Board System category.php sql injectionPHPGurukul Notice Board System
- CVE-2025-4059code-projects Prison Management System Prison_Mgmt_Sys addrecord stack-based overflowcode-projects Prison Management System
- CVE-2025-3929Stored XSS vulnerability in MDaemon Email ServerMDaemon Email Server
- CVE-2025-4058Projectworlds Online Examination System Bloodgroop_process.php sql injectionProjectworlds Online Examination System
- CVE-2025-1194Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-3452SecuPress Free <= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationSecuPress with Simple SSL – Simple and Performant Security
- CVE-2025-2893Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Blockjegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…
- CVE-2024-12273Calculated Fields Form < 5.2.62 - Admin+ Stored XSSCalculated Fields Form
- CVE-2025-46329Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logssnowflakedb libsnowflakeclient
- CVE-2025-46343n8n Vulnerable to Stored XSS through Attachments View Endpointn8n-io n8n · n8n
- CVE-2025-46338Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/uploadadvplyr audiobookshelf
- CVE-2025-46330Snowflake Connector for C/C++ retries malformed requestssnowflakedb libsnowflakeclient
- CVE-2025-31197The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24179A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24270This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24271An access issue was addressed with improved access restrictions.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24251The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31202A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-31203An integer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-30445A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3