CVEs published April 30, 2025
110 CVEs were published on April 30, 2025: 10 critical, 43 high.
- Published
- 110
- Critical
- 10
- High
- 43
- Medium
- 53
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Bosch Rexroth AG ctrlX OS - Device Admin
- 12
- Netgear JWNR2000v2
- 7
- HCL Software HCL Domino Leap
- 6
- Delta Electronics ISPSoft
- 5
- Tesla Model S
- 5
- ABB ANC · ABB ANC-L +1
- 3
- Bosch Rexroth AG ctrlX OS - Solutions
- 3
- HCL Software HCL Domino Volt
- 3
- PHPGurukul Pre-School Enrollment System
- 3
- vllm-project vllm · vllm
- 3
Critical 10
- CVE-2025-46558org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown contentxwiki-contrib syntax-markdown · org.xwiki.contrib.markdown:…
- CVE-2025-30392Azure AI Bot Elevation of Privilege VulnerabilityMicrosoft Azure AI Bot Service
- CVE-2025-30390Azure ML Compute Elevation of Privilege VulnerabilityMicrosoft Azure Machine Learning
- CVE-2025-32973org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming rightxwiki-platform · org.xwiki.platform:xwiki-platform-componen…
- CVE-2025-32974org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typexwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2025-32444vLLM Vulnerable to Remote Code Execution via Mooncake Integrationvllm-project vllm · vllm
- CVE-2025-44192SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance.
- CVE-2025-45017A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0.
- CVE-2025-45018A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management Syste
- CVE-2025-45019A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0.
High 43
- CVE-2025-4142Netgear EX6200 sub_3C8EC buffer overflowNetgear EX6200
- CVE-2025-4141Netgear EX6200 sub_3C03C buffer overflowNetgear EX6200
- CVE-2025-4140Netgear EX6120 sub_30394 buffer overflowNetgear EX6120
- CVE-2023-37535HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerabilityHCL Software HCL Domino Leap
- CVE-2025-4139Netgear EX6120 fwAcosCgiInbound buffer overflowNetgear EX6120
- CVE-2025-2082Tesla Model 3 VCSEC Integer Overflow Remote Code Execution VulnerabilityTesla Model
- CVE-2024-6032Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution VulnerabilityTesla Model S
- CVE-2024-6030Tesla Model S oFono Unnecessary Privileges Sandbox Escape VulnerabilityTesla Model S
- CVE-2024-13943Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape VulnerabilityTesla Model S
- CVE-2024-6031Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution VulnerabilityTesla Model S
- CVE-2025-27611base-x homograph attack allows Unicode lookalike characters to bypass validation.cryptocoinjs base-x · base-x
- CVE-2025-2170A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific condSonicWall SMA1000
- CVE-2024-9876Application is vulnerable to Privilege escalationABB ANC · ABB ANC-L +1
- CVE-2025-46557Any user with view access to the XWiki space can change the authenticatorxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2025-32777Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Pluginvolcano-sh volcano · volcano.sh/volcano
- CVE-2025-21416Azure Virtual Desktop Elevation of Privilege VulnerabilityMicrosoft Azure Virtual Desktop
- CVE-2025-33074Azure Functions Remote Code Execution VulnerabilityMicrosoft Azure Functions
- CVE-2025-30389Azure Bot Framework SDK Elevation of Privilege VulnerabilityMicrosoft Azure AI Bot Service
- CVE-2025-30391Microsoft Dynamics Information Disclosure VulnerabilityMicrosoft Dynamics 365 Customer Service
- CVE-2025-46342Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statementskyverno · github.com/kyverno/kyverno
- CVE-2025-27134Privilege escalation in Joplin server via user patch endpointlaurent22 joplin
- CVE-2025-27409Joplin Server Vulnerable to Path Traversallaurent22 joplin
- CVE-2025-4120Netgear JWNR2000v2 sub_4238E8 buffer overflowNetgear JWNR2000v2
- CVE-2025-3395Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.ThABB Automation Builder
- CVE-2025-3394Vulnerability in user management of Automation BuilderABB Automation Builder
- CVE-2025-4116Netgear JWNR2000v2 get_cur_lang_ver buffer overflowNetgear JWNR2000v2
- CVE-2025-4115Netgear JWNR2000v2 default_version_is_new buffer overflowNetgear JWNR2000v2
- CVE-2025-4114Netgear JWNR2000v2 check_language_file buffer overflowNetgear JWNR2000v2
- CVE-2025-24351A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attaBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24350A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privilegeBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24349A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) aBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24346A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24338A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attBosch Rexroth AG ctrlX OS - Solutions
- CVE-2025-4125ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityDelta Electronics ISPSoft
- CVE-2025-4124ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityDelta Electronics ISPSoft
- CVE-2025-22884ISPSoft File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityDelta Electronics ISPSoft
- CVE-2025-22883ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityDelta Electronics ISPSoft
- CVE-2025-22882ISPSoft File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityDelta Electronics ISPSoft
- CVE-2025-30202Data exposure via ZeroMQ on multi-node vLLM deploymentvllm-project vllm · vllm
- CVE-2025-44193SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint.
- CVE-2025-44194SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household.
- CVE-2025-45020A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v
- CVE-2025-46619A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthor
Medium, low and unrated 57
- CVE-2024-30146HCL Domino Leap is affected by improper access controlHCL Software HCL Domino Leap
- CVE-2024-30145HCL Domino Volt and Domino Leap are affected by a cross-site scripting (XSS) vulnerabilityHCL Software HCL Domino Leap
- CVE-2024-30115HCL Domino Volt and Domino Leap are affected by a cross-site scripting (XSS) vulnerabilityHCL Software HCL Domino Leap
- CVE-2023-45721HCL Domino Volt and Domino Leap are affected by a disclosure of private personal information vulnerabilityHCL Software HCL Domino Leap
- CVE-2023-37517HCL Domino Volt and Domino Leap are affected by missing "no cache" headersHCL Software HCL Domino Leap
- CVE-2022-42450HCL Domino Volt is affected by Cross-site scripting (XSS)HCL Software HCL Domino Volt
- CVE-2022-42449HCL Domino Volt is affected by an unrestricted upload of a dangerous file typeHCL Software HCL Domino Volt
- CVE-2022-27562HCL Domino Volt is affected by an unrestricted upload of a dangerous file typeHCL Software HCL Domino Volt
- CVE-2025-30422A buffer overflow was addressed with improved input validation.Apple AirPlay audio SDK · Apple AirPlay video SDK
- CVE-2025-24132The issue was addressed with improved memory handling.Apple AirPlay audio SDK · Apple AirPlay video SDK
- CVE-2024-6029Tesla Model S Iris Modem Race Condition Firewall Bypass VulnerabilityTesla Model S
- CVE-2025-4136Weitong Mall Sale Endpoint improper authorizationWeitong Mall
- CVE-2024-9877Sensitive information submitted using GET methodABB ANC · ABB ANC-L +1
- CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST APIxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2025-24887OpenCTI bypass of protected attribute updateOpenCTI-Platform opencti · pycti
- CVE-2025-46331OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2024-47784Unverified Password ChangeABB ANC · ABB ANC-L +1
- CVE-2025-4135Netgear WG302v2 ui_get_input_value command injectionNetgear WG302v2
- CVE-2025-24091An app could impersonate system notifications.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-39413WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerabilityDavid Gwyer Simple Sitemap – Create a Responsive HTML Sitem…
- CVE-2025-3599Symantec Endpoint Protection Elevation of PrivilegeSymantec Endpoint Protection
- CVE-2025-3859Firefox Focus elide URL allows address bar spoofingMozilla Focus
- CVE-2025-32376Discourse DM limits aren’t always properly enforceddiscourse
- CVE-2025-32972The lesscss script service allows cache clearing without programming rightxwiki-platform · org.xwiki.platform:xwiki-platform-lesscss-…
- CVE-2025-32971XWiki Solr script service doesn't take dropped programming right into accountxwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2025-32970org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-wysiwyg-…
- CVE-2025-4122Netgear JWNR2000v2 sub_435E04 command injectionNetgear JWNR2000v2
- CVE-2025-4121Netgear JWNR2000v2 cmd_wireless command injectionNetgear JWNR2000v2
- CVE-2025-4119Weitong Mall Product Statistics queryTotal access controlWeitong Mall
- CVE-2025-4118Weitong Mall Product History historyList access controlWeitong Mall
- CVE-2025-4117Netgear JWNR2000v2 sub_41A914 buffer overflowNetgear JWNR2000v2
- CVE-2025-27532A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24348A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) Bosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24347A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) Bosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24345A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24344A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbBosch Rexroth AG ctrlX OS - Solutions
- CVE-2025-24343A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atBosch Rexroth AG ctrlX OS - Solutions
- CVE-2025-24342A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernaBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24341A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-4113PHPGurukul Curfew e-Pass Management System edit-pass-detail.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2025-4112PHPGurukul Student Record System add-course.php sql injectionPHPGurukul Student Record System
- CVE-2025-24340A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintBosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-24339A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the Bosch Rexroth AG ctrlX OS - Device Admin
- CVE-2025-4111PHPGurukul Pre-School Enrollment System visitor-details.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-4110PHPGurukul Pre-School Enrollment System edit-teacher.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-4109PHPGurukul Pre-School Enrollment System edit-subadmin.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-4108PHPGurukul Student Record System add-subject.php sql injectionPHPGurukul Student Record System
- CVE-2025-2890tagDiv Opt-In Builder <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId ParametertagDiv Opt-In Builder
- CVE-2025-3471SureForms < 1.4.4 - Contributor+ Settings UpdateSureForms
- CVE-2025-3953WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Updateveronalabs WP Statistics – Simple, privacy-friendly Google…
- CVE-2025-46560vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of servicevllm-project vllm · vllm
- CVE-2025-45007A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0.
- CVE-2025-45009A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0.
- CVE-2025-45010A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System
- CVE-2025-45011A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0.
- CVE-2025-45015A Cross-Site Scripting (XSS) vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Man
- CVE-2025-45021A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0.