# CVEs published 2025-04-30

110 CVEs were published on April 30, 2025: 10 critical, 43 high. Days are UTC.

- [CVE-2025-4142](https://cve.now/CVE-2025-4142.md): Netgear EX6200 sub\_3C8EC buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-4141](https://cve.now/CVE-2025-4141.md): Netgear EX6200 sub\_3C03C buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-4140](https://cve.now/CVE-2025-4140.md): Netgear EX6120 sub\_30394 buffer overflow (CVSS 8.7, Netgear EX6120)
- [CVE-2024-30146](https://cve.now/CVE-2024-30146.md): HCL Domino Leap is affected by improper access control (CVSS 4.1, HCL Software HCL Domino Leap)
- [CVE-2024-30145](https://cve.now/CVE-2024-30145.md): HCL Domino Volt and Domino Leap are affected by a cross-site scripting (XSS) vulnerability (CVSS 6.5, HCL Software HCL Domino Leap)
- [CVE-2024-30115](https://cve.now/CVE-2024-30115.md): HCL Domino Volt and Domino Leap are affected by a cross-site scripting (XSS) vulnerability (CVSS 6.3, HCL Software HCL Domino Leap)
- [CVE-2023-45721](https://cve.now/CVE-2023-45721.md): HCL Domino Volt and Domino Leap are affected by a disclosure of private personal information vulnerability (CVSS 5.3, HCL Software HCL Domino Leap)
- [CVE-2023-37535](https://cve.now/CVE-2023-37535.md): HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability (CVSS 7.1, HCL Software HCL Domino Leap)
- [CVE-2023-37517](https://cve.now/CVE-2023-37517.md): HCL Domino Volt and Domino Leap are affected by missing "no cache" headers (CVSS 3.2, HCL Software HCL Domino Leap)
- [CVE-2022-42450](https://cve.now/CVE-2022-42450.md): HCL Domino Volt is affected by Cross-site scripting (XSS) (CVSS 4.6, HCL Software HCL Domino Volt)
- [CVE-2022-42449](https://cve.now/CVE-2022-42449.md): HCL Domino Volt is affected by an unrestricted upload of a dangerous file type (CVSS 4.6, HCL Software HCL Domino Volt)
- [CVE-2022-27562](https://cve.now/CVE-2022-27562.md): HCL Domino Volt is affected by an unrestricted upload of a dangerous file type (CVSS 4.6, HCL Software HCL Domino Volt)
- [CVE-2025-30422](https://cve.now/CVE-2025-30422.md): A buffer overflow was addressed with improved input validation. (CVSS 6.5, Apple AirPlay audio SDK · Apple AirPlay video SDK)
- [CVE-2025-24132](https://cve.now/CVE-2025-24132.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple AirPlay audio SDK · Apple AirPlay video SDK)
- [CVE-2025-4139](https://cve.now/CVE-2025-4139.md): Netgear EX6120 fwAcosCgiInbound buffer overflow (CVSS 8.7, Netgear EX6120)
- [CVE-2025-2082](https://cve.now/CVE-2025-2082.md): Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability (CVSS 7.5, Tesla Model)
- [CVE-2024-6032](https://cve.now/CVE-2024-6032.md): Tesla Model S Iris Modem ql\_atfwd Command Injection Code Execution Vulnerability (CVSS 7.8, Tesla Model S)
- [CVE-2024-6030](https://cve.now/CVE-2024-6030.md): Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability (CVSS 7.0, Tesla Model S)
- [CVE-2024-13943](https://cve.now/CVE-2024-13943.md): Tesla Model S Iris Modem QCMAP\_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability (CVSS 7.8, Tesla Model S)
- [CVE-2024-6031](https://cve.now/CVE-2024-6031.md): Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, Tesla Model S)
- [CVE-2024-6029](https://cve.now/CVE-2024-6029.md): Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability (CVSS 5.0, Tesla Model S)
- [CVE-2025-27611](https://cve.now/CVE-2025-27611.md): base-x homograph attack allows Unicode lookalike characters to bypass validation. (CVSS 8.7, cryptocoinjs base-x · base-x)
- [CVE-2025-4136](https://cve.now/CVE-2025-4136.md): Weitong Mall Sale Endpoint improper authorization (CVSS 5.3, Weitong Mall)
- [CVE-2025-2170](https://cve.now/CVE-2025-2170.md): A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific cond (CVSS 7.2, SonicWall SMA1000)
- [CVE-2024-9877](https://cve.now/CVE-2024-9877.md): Sensitive information submitted using GET method (CVSS 5.3, ABB ANC · ABB ANC-L +1)
- [CVE-2024-9876](https://cve.now/CVE-2024-9876.md): Application is vulnerable to Privilege escalation (CVSS 8.5, ABB ANC · ABB ANC-L +1)
- [CVE-2025-46554](https://cve.now/CVE-2025-46554.md): XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2025-46557](https://cve.now/CVE-2025-46557.md): Any user with view access to the XWiki space can change the authenticator (CVSS 8.4, xwiki-platform · org.xwiki.platform:xwiki-platform-security…)
- [CVE-2025-46558](https://cve.now/CVE-2025-46558.md): org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content (CVSS 9.1, xwiki-contrib syntax-markdown · org.xwiki.contrib.markdown:…)
- [CVE-2025-24887](https://cve.now/CVE-2025-24887.md): OpenCTI bypass of protected attribute update (CVSS 6.3, OpenCTI-Platform opencti · pycti)
- [CVE-2025-32777](https://cve.now/CVE-2025-32777.md): Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin (CVSS 8.2, volcano-sh volcano · volcano.sh/volcano)
- [CVE-2025-46331](https://cve.now/CVE-2025-46331.md): OpenFGA Authorization Bypass (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2024-47784](https://cve.now/CVE-2024-47784.md): Unverified Password Change (CVSS 2.1, ABB ANC · ABB ANC-L +1)
- [CVE-2025-4135](https://cve.now/CVE-2025-4135.md): Netgear WG302v2 ui\_get\_input\_value command injection (CVSS 5.3, Netgear WG302v2)
- [CVE-2025-24091](https://cve.now/CVE-2025-24091.md): An app could impersonate system notifications. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-39413](https://cve.now/CVE-2025-39413.md): WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin \<= 3.6.0 - Broken Access Control vulnerability (CVSS 4.3, David Gwyer Simple Sitemap – Create a Responsive HTML Sitem…)
- [CVE-2025-21416](https://cve.now/CVE-2025-21416.md): Azure Virtual Desktop Elevation of Privilege Vulnerability (CVSS 8.5, Microsoft Azure Virtual Desktop)
- [CVE-2025-30392](https://cve.now/CVE-2025-30392.md): Azure AI Bot Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Azure AI Bot Service)
- [CVE-2025-30390](https://cve.now/CVE-2025-30390.md): Azure ML Compute Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure Machine Learning)
- [CVE-2025-33074](https://cve.now/CVE-2025-33074.md): Azure Functions Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Azure Functions)
- [CVE-2025-30389](https://cve.now/CVE-2025-30389.md): Azure Bot Framework SDK Elevation of Privilege Vulnerability (CVSS 8.7, Microsoft Azure AI Bot Service)
- [CVE-2025-30391](https://cve.now/CVE-2025-30391.md): Microsoft Dynamics Information Disclosure Vulnerability (CVSS 8.1, Microsoft Dynamics 365 Customer Service)
- [CVE-2025-3599](https://cve.now/CVE-2025-3599.md): Symantec Endpoint Protection Elevation of Privilege (CVSS 6.5, Symantec Endpoint Protection)
- [CVE-2025-3859](https://cve.now/CVE-2025-3859.md): Firefox Focus elide URL allows address bar spoofing (CVSS 4.3, Mozilla Focus)
- [CVE-2025-32376](https://cve.now/CVE-2025-32376.md): Discourse DM limits aren’t always properly enforced (CVSS 4.8, discourse)
- [CVE-2025-46342](https://cve.now/CVE-2025-46342.md): Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements (CVSS 8.6, kyverno · github.com/kyverno/kyverno)
- [CVE-2025-27134](https://cve.now/CVE-2025-27134.md): Privilege escalation in Joplin server via user patch endpoint (CVSS 8.8, laurent22 joplin)
- [CVE-2025-27409](https://cve.now/CVE-2025-27409.md): Joplin Server Vulnerable to Path Traversal (CVSS 7.5, laurent22 joplin)
- [CVE-2025-32973](https://cve.now/CVE-2025-32973.md): org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-componen…)
- [CVE-2025-32974](https://cve.now/CVE-2025-32974.md): org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-security…)
- [CVE-2025-32972](https://cve.now/CVE-2025-32972.md): The lesscss script service allows cache clearing without programming right (CVSS 2.7, xwiki-platform · org.xwiki.platform:xwiki-platform-lesscss-…)
- [CVE-2025-32971](https://cve.now/CVE-2025-32971.md): XWiki Solr script service doesn't take dropped programming right into account (CVSS 3.8, xwiki-platform · org.xwiki.platform:xwiki-platform-search-s…)
- [CVE-2025-32970](https://cve.now/CVE-2025-32970.md): org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability (CVSS 6.1, xwiki-platform · org.xwiki.platform:xwiki-platform-wysiwyg-…)
- [CVE-2025-4122](https://cve.now/CVE-2025-4122.md): Netgear JWNR2000v2 sub\_435E04 command injection (CVSS 5.3, Netgear JWNR2000v2)
- [CVE-2025-4121](https://cve.now/CVE-2025-4121.md): Netgear JWNR2000v2 cmd\_wireless command injection (CVSS 5.3, Netgear JWNR2000v2)
- [CVE-2025-4120](https://cve.now/CVE-2025-4120.md): Netgear JWNR2000v2 sub\_4238E8 buffer overflow (CVSS 8.7, Netgear JWNR2000v2)
- [CVE-2025-4119](https://cve.now/CVE-2025-4119.md): Weitong Mall Product Statistics queryTotal access control (CVSS 6.9, Weitong Mall)
- [CVE-2025-4118](https://cve.now/CVE-2025-4118.md): Weitong Mall Product History historyList access control (CVSS 6.9, Weitong Mall)
- [CVE-2025-4117](https://cve.now/CVE-2025-4117.md): Netgear JWNR2000v2 sub\_41A914 buffer overflow (CVSS 5.1, Netgear JWNR2000v2)
- [CVE-2025-3395](https://cve.now/CVE-2025-3395.md): Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.Th (CVSS 8.4, ABB Automation Builder)
- [CVE-2025-3394](https://cve.now/CVE-2025-3394.md): Vulnerability in user management of Automation Builder (CVSS 8.5, ABB Automation Builder)
- [CVE-2025-4116](https://cve.now/CVE-2025-4116.md): Netgear JWNR2000v2 get\_cur\_lang\_ver buffer overflow (CVSS 8.7, Netgear JWNR2000v2)
- [CVE-2025-4115](https://cve.now/CVE-2025-4115.md): Netgear JWNR2000v2 default\_version\_is\_new buffer overflow (CVSS 8.7, Netgear JWNR2000v2)
- [CVE-2025-4114](https://cve.now/CVE-2025-4114.md): Netgear JWNR2000v2 check\_language\_file buffer overflow (CVSS 8.7, Netgear JWNR2000v2)
- [CVE-2025-27532](https://cve.now/CVE-2025-27532.md): A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) att (CVSS 6.5, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24351](https://cve.now/CVE-2025-24351.md): A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atta (CVSS 8.8, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24350](https://cve.now/CVE-2025-24350.md): A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privilege (CVSS 7.1, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24349](https://cve.now/CVE-2025-24349.md): A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) a (CVSS 7.1, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24348](https://cve.now/CVE-2025-24348.md): A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) (CVSS 5.4, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24347](https://cve.now/CVE-2025-24347.md): A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) (CVSS 6.5, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24346](https://cve.now/CVE-2025-24346.md): A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to ma (CVSS 7.5, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24345](https://cve.now/CVE-2025-24345.md): A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to m (CVSS 6.3, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24344](https://cve.now/CVE-2025-24344.md): A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arb (CVSS 6.3, Bosch Rexroth AG ctrlX OS - Solutions)
- [CVE-2025-24343](https://cve.now/CVE-2025-24343.md): A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) at (CVSS 5.4, Bosch Rexroth AG ctrlX OS - Solutions)
- [CVE-2025-24342](https://cve.now/CVE-2025-24342.md): A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid userna (CVSS 5.3, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24341](https://cve.now/CVE-2025-24341.md): A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (Do (CVSS 6.5, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-4113](https://cve.now/CVE-2025-4113.md): PHPGurukul Curfew e-Pass Management System edit-pass-detail.php sql injection (CVSS 5.3, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-4112](https://cve.now/CVE-2025-4112.md): PHPGurukul Student Record System add-course.php sql injection (CVSS 6.9, PHPGurukul Student Record System)
- [CVE-2025-24340](https://cve.now/CVE-2025-24340.md): A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaint (CVSS 6.5, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24339](https://cve.now/CVE-2025-24339.md): A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the (CVSS 5.0, Bosch Rexroth AG ctrlX OS - Device Admin)
- [CVE-2025-24338](https://cve.now/CVE-2025-24338.md): A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) att (CVSS 7.1, Bosch Rexroth AG ctrlX OS - Solutions)
- [CVE-2025-4111](https://cve.now/CVE-2025-4111.md): PHPGurukul Pre-School Enrollment System visitor-details.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-4110](https://cve.now/CVE-2025-4110.md): PHPGurukul Pre-School Enrollment System edit-teacher.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-4109](https://cve.now/CVE-2025-4109.md): PHPGurukul Pre-School Enrollment System edit-subadmin.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-4108](https://cve.now/CVE-2025-4108.md): PHPGurukul Student Record System add-subject.php sql injection (CVSS 6.9, PHPGurukul Student Record System)
- [CVE-2025-2890](https://cve.now/CVE-2025-2890.md): tagDiv Opt-In Builder \<= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter (CVSS 6.5, tagDiv Opt-In Builder)
- [CVE-2025-4125](https://cve.now/CVE-2025-4125.md): ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics ISPSoft)
- [CVE-2025-4124](https://cve.now/CVE-2025-4124.md): ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics ISPSoft)
- [CVE-2025-22884](https://cve.now/CVE-2025-22884.md): ISPSoft File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics ISPSoft)
- [CVE-2025-22883](https://cve.now/CVE-2025-22883.md): ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics ISPSoft)
- [CVE-2025-22882](https://cve.now/CVE-2025-22882.md): ISPSoft File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics ISPSoft)
- [CVE-2025-3471](https://cve.now/CVE-2025-3471.md): SureForms \< 1.4.4 - Contributor+ Settings Update (CVSS 4.9, SureForms)
- [CVE-2025-3953](https://cve.now/CVE-2025-3953.md): WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin \<= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update (CVSS 5.4, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2025-32444](https://cve.now/CVE-2025-32444.md): vLLM Vulnerable to Remote Code Execution via Mooncake Integration (CVSS 10.0, vllm-project vllm · vllm)
- [CVE-2025-46560](https://cve.now/CVE-2025-46560.md): vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-30202](https://cve.now/CVE-2025-30202.md): Data exposure via ZeroMQ on multi-node vLLM deployment (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2025-44192](https://cve.now/CVE-2025-44192.md): SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay\_management/admin/?page=view\_clearance. (CVSS 9.8)
- [CVE-2025-44193](https://cve.now/CVE-2025-44193.md): SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay\_management/admin/?page=view\_complaint. (CVSS 7.6)
- [CVE-2025-44194](https://cve.now/CVE-2025-44194.md): SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay\_management/admin/?page=view\_household. (CVSS 7.3)
- [CVE-2025-45007](https://cve.now/CVE-2025-45007.md): A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. (CVSS 4.8)
- [CVE-2025-45009](https://cve.now/CVE-2025-45009.md): A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. (CVSS 5.3)
- [CVE-2025-45010](https://cve.now/CVE-2025-45010.md): A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System (CVSS 5.3)
- [CVE-2025-45011](https://cve.now/CVE-2025-45011.md): A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. (CVSS 5.3)
- [CVE-2025-45015](https://cve.now/CVE-2025-45015.md): A Cross-Site Scripting (XSS) vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Man (CVSS 6.1)
- [CVE-2025-45017](https://cve.now/CVE-2025-45017.md): A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. (CVSS 9.8)
- [CVE-2025-45018](https://cve.now/CVE-2025-45018.md): A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management Syste (CVSS 9.8)
- [CVE-2025-45019](https://cve.now/CVE-2025-45019.md): A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. (CVSS 9.8)
- [CVE-2025-45020](https://cve.now/CVE-2025-45020.md): A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v (CVSS 7.2)
- [CVE-2025-45021](https://cve.now/CVE-2025-45021.md): A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. (CVSS 5.3)
- [CVE-2025-46619](https://cve.now/CVE-2025-46619.md): A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthor (CVSS 7.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.