CVEs published May 1, 2025
372 CVEs were published on May 1, 2025: 10 critical, 85 high.
- Published
- 372
- Critical
- 10
- High
- 85
- Medium
- 136
- Low
- 3
- Unrated
- 138
- Now in CISA KEV
- 0
- Fix available
- 67
Most affected products
- Linux
- 245
- PCMan FTP Server
- 10
- Netgear EX6200
- 6
- KUNBUS Revolution Pi PiCtory
- 3
- mra13 Simple Shopping Cart
- 3
- PHPGurukul Boat Booking System
- 3
- WP Maps
- 3
- Elastic Kibana
- 2
- IBM MQ Operator
- 2
- MicroDicom DICOM Viewer
- 2
Critical 10
- CVE-2025-35996KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web PageKUNBUS Revolution Pi PiCtory
- CVE-2025-32011KUNBUS Revolution Pi Authentication Bypass by Primary WeaknessKUNBUS Revolution Pi PiCtory
- CVE-2025-24522KUNBUS Revolution Pi Authentication Bypass by Primary WeaknessKUNBUS Revolution Pi OS Bookworm
- CVE-2025-46337SQL injection in ADOdb PostgreSQL driver pg_insert_id() methodADOdb · adodb/adodb-php
- CVE-2022-49770ceph: avoid putting the realm twice when decoding snaps failsLinux
- CVE-2025-37778ksmbd: Fix dangling pointer in krb_authenticateLinux
- CVE-2025-37750smb: client: fix UAF in decryption with multichannelLinux
- CVE-2025-27007WordPress SureTriggers <= 1.0.82 - Privilege Escalation VulnerabilityBrainstorm Force OttoKit
- CVE-2024-48905Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.
- CVE-2025-47154LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowLadybird
High 85
- CVE-2025-43595MSP360 Backup (for Linux) insecure filesystem permissionsMSP360 Backup
- CVE-2025-46569OPA server Data API HTTP path injection of Regoopen-policy-agent opa · github.com/open-policy-agent/opa… +2
- CVE-2025-36521MicroDicom DICOM Viewer Out-of-bounds ReadMicroDicom DICOM Viewer
- CVE-2025-35975MicroDicom DICOM Viewer Out-of-bounds WriteMicroDicom DICOM Viewer
- CVE-2025-46568Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read VulnerabilityStirling-Tools Stirling-PDF
- CVE-2022-49931IB/hfi1: Correctly move list in sc_disable()Linux
- CVE-2022-49928SUNRPC: Fix null-ptr-deref when xps sysfs alloc failedLinux
- CVE-2022-49921net: sched: Fix use after free in red_enqueue()Linux
- CVE-2022-49920netfilter: nf_tables: netlink notifier might race to release objectsLinux
- CVE-2022-49919netfilter: nf_tables: release flow rule object from commit pathLinux
- CVE-2022-49910Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sduLinux
- CVE-2022-49905net/smc: Fix possible leaked pernet namespace in smc_init()Linux
- CVE-2022-49899fscrypt: stop using keyrings subsystem for fscrypt_master_keyLinux
- CVE-2022-49898btrfs: fix tree mod log mishandling of reallocated nodesLinux
- CVE-2022-49892ftrace: Fix use-after-free for dynamic ftrace_opsLinux
- CVE-2022-49886x86/tdx: Panic on bad configs that #VE on "private" memory accessLinux
- CVE-2022-49884KVM: Initialize gfn_to_pfn_cache locks in dedicated helperLinux
- CVE-2022-49883KVM: x86: smm: number of GPRs in the SMRAM image depends on the image formatLinux
- CVE-2022-49882KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cacheLinux
- CVE-2022-49872net: gso: fix panic on frag_list with mixed head alloc typesLinux
- CVE-2022-49858octeontx2-pf: Fix SQE threshold checkingLinux
- CVE-2022-49846udf: Fix a slab-out-of-bounds write bug in udf_find_entry()Linux
- CVE-2022-49844can: dev: fix skb drop checkLinux
- CVE-2022-49842ASoC: core: Fix use-after-free in snd_soc_exit()Linux
- CVE-2022-49840bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()Linux
- CVE-2022-49834nilfs2: fix use-after-free bug of ns_writer on remountLinux
- CVE-2022-49826ata: libata-transport: fix double ata_host_put() in ata_tport_add()Linux
- CVE-2022-49814kcm: close race conditions on sk_receive_queueLinux
- CVE-2022-49804s390: avoid using global register for current_stack_pointerLinux
- CVE-2022-49792iio: adc: mp2629: fix potential array out of bound accessLinux
- CVE-2022-49789scsi: zfcp: Fix double free of FSF request when qdio send failsLinux
- CVE-2022-49775tcp: cdg: allow tcp_cdg_release() to be called multiple timesLinux
- CVE-2022-497689p: trans_fd/p9_conn_cancel: drop client lock earlierLinux
- CVE-2022-49763ntfs: fix use-after-free in ntfs_attr_find()Linux
- CVE-2025-23254NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by locaNVIDIA TensorRT-LLM
- CVE-2025-23244NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions.NVIDIA GPU Display Driver, vGPU Software, Cloud Gaming
- CVE-2025-37791ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()Linux
- CVE-2025-37790net: mctp: Set SOCK_RCU_FREELinux
- CVE-2025-37789net: openvswitch: fix nested key length validation in the set() actionLinux
- CVE-2025-37779lib/iov_iter: fix to increase non slab folio refcountLinux
- CVE-2025-37777ksmbd: fix use-after-free in __smb2_lease_break_noti()Linux
- CVE-2025-37776ksmbd: fix use-after-free in smb_break_all_levII_oplock()Linux
- CVE-2025-37774slab: ensure slab->obj_exts is clear in a newly allocated slab pageLinux
- CVE-2025-37765drm/nouveau: prime: fix ttm_bo_delayed_delete oopsLinux
- CVE-2025-37763drm/imagination: take paired job referenceLinux
- CVE-2025-37761drm/xe: Fix an out-of-bounds shift when invalidating TLBLinux
- CVE-2025-37757tipc: fix memory leak in tipc_link_xmitLinux
- CVE-2025-37756net: tls: explicitly disallow disconnectLinux
- CVE-2025-37755net: libwx: handle page_pool_dev_alloc_pages errorLinux
- CVE-2025-37752net_sched: sch_sfq: move the limit validationLinux
- CVE-2025-37751x86/cpu: Avoid running off the end of an AMD erratum tableLinux
- CVE-2025-37749net: ppp: Add bound checking for skb data on ppp_sync_txmungLinux
- CVE-2025-37741jfs: Prevent copying of nlink with value 0 from disk inodeLinux
- CVE-2025-37738ext4: ignore xattrs past endLinux
- CVE-2025-23159media: venus: hfi: add a check to handle OOB in sfr regionLinux
- CVE-2025-23158media: venus: hfi: add check to handle incorrect queue sizeLinux
- CVE-2025-23157media: venus: hfi_parser: add check to avoid out of bound accessLinux
- CVE-2025-23156media: venus: hfi_parser: refactor hfi packet parsing logicLinux
- CVE-2025-23155net: stmmac: Fix accessing freed irq affinity_hintLinux
- CVE-2025-23151bus: mhi: host: Fix race between unprepare and queue_bufLinux
- CVE-2025-23150ext4: fix off-by-one error in do_splitLinux
- CVE-2025-23145mptcp: fix NULL pointer in can_accept_new_subflowLinux
- CVE-2025-23142sctp: detect and prevent references to a freed transport in sendmsgLinux
- CVE-2025-23141KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accessesLinux
- CVE-2025-4150Netgear EX6200 sub_54340 buffer overflowNetgear EX6200
- CVE-2025-3952Projectopia – WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option DeletionProjectopia – Project Management Tool
- CVE-2025-4149Netgear EX6200 sub_54014 buffer overflowNetgear EX6200
- CVE-2025-1304NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Uploadspicethemes NewsBlogger
- CVE-2025-1305NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installationspicethemes NewsBlogger
- CVE-2025-4148Netgear EX6200 sub_503FC buffer overflowNetgear EX6200
- CVE-2025-2816Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Updatea3rev Page View Count
- CVE-2025-4147Netgear EX6200 sub_47F7C buffer overflowNetgear EX6200
- CVE-2025-4146Netgear EX6200 sub_41940 buffer overflowNetgear EX6200
- CVE-2025-4145Netgear EX6200 sub_3D0BC buffer overflowNetgear EX6200
- CVE-2024-48907Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.
- CVE-2025-32887An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.
- CVE-2025-32888An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12.
- CVE-2025-32889An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.
- CVE-2025-46625Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker tha
- CVE-2025-46626Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 a
- CVE-2025-46627Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calcula
- CVE-2025-46628Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacke
- CVE-2025-46633Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt
- CVE-2025-46634Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated a
- CVE-2025-46635An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices.
Medium, low and unrated 277
- CVE-2025-4185Wangshen SecGate 3600 g=obj_area_export_save path traversalWangshen SecGate
- CVE-2025-4184PCMan FTP Server QUOTE Command buffer overflowPCMan FTP Server
- CVE-2025-4183PCMan FTP Server RECV Command buffer overflowPCMan FTP Server
- CVE-2025-4182PCMan FTP Server BELL Command buffer overflowPCMan FTP Server
- CVE-2025-4181PCMan FTP Server SEND Command buffer overflowPCMan FTP Server
- CVE-2024-52903IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2025-1333IBM MQ Operator information disclosureIBM MQ Operator
- CVE-2025-4180PCMan FTP Server TRACE Command buffer overflowPCMan FTP Server
- CVE-2025-4178xiaowei1118 java_server File Upload API FoodController.java path traversalxiaowei1118 java_server
- CVE-2025-4176PHPGurukul Blood Bank & Donor Management System request-received-bydonar.php sql injectionPHPGurukul Blood Bank & Donor Management System
- CVE-2025-27365IBM MQ Operator denial of serviceIBM MQ Operator
- CVE-2025-4175AlanBinu007 Spring-Boot-Advanced-Projects Upload Profile API Endpoint UserProfileController.java uploadUserProfileImage path traversalAlanBinu007 Spring-Boot-Advanced-Projects
- CVE-2025-4174PHPGurukul COVID19 Testing Management System login.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-36558KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web PageKUNBUS Revolution Pi PiCtory
- CVE-2025-3517Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a prevDevolutions Server
- CVE-2025-46567LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.pyhiyouga LLaMA-Factory · llamafactory
- CVE-2025-46566Dataease redshift JDBC Connection Remote Code Executiondataease
- CVE-2025-46565Vite's server.fs.deny bypassed with /. for files under project rootvitejs vite · vite
- CVE-2025-46345Auth0 Account Link Extension JWT Invalid Signature Validationauth0-extensions auth0-account-link-extension
- CVE-2025-4173SourceCodester Online Eyewear Shop Master.php delete_cart sql injectionSourceCodester Online Eyewear Shop
- CVE-2025-23246NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows a guest to conNVIDIA vGPU Software, Cloud Gaming
- CVE-2022-49930RDMA/hns: Fix NULL pointer problem in free_mr_init()Linux
- CVE-2022-49929RDMA/rxe: Fix mr leak in RESPST_ERR_RNRLinux
- CVE-2022-49927nfs4: Fix kmemleak when allocate slot failedLinux
- CVE-2022-49926net: dsa: Fix possible memory leaks in dsa_loop_init()Linux
- CVE-2022-49925RDMA/core: Fix null-ptr-deref in ib_core_cleanup()Linux
- CVE-2022-49924nfc: fdp: Fix potential memory leak in fdp_nci_send()Linux
- CVE-2022-49923nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()Linux
- CVE-2022-49922nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()Linux
- CVE-2022-49918ipvs: fix WARNING in __ip_vs_cleanup_batch()Linux
- CVE-2022-49917ipvs: fix WARNING in ip_vs_app_net_cleanup()Linux
- CVE-2022-49916rose: Fix NULL pointer dereference in rose_send_frame()Linux
- CVE-2022-49915mISDN: fix possible memory leak in mISDN_register_device()Linux
- CVE-2022-49914btrfs: fix inode list leak during backref walking at resolve_indirect_refs()Linux
- CVE-2022-49913btrfs: fix inode list leak during backref walking at find_parent_nodes()Linux
- CVE-2022-49912btrfs: fix ulist leaks in error paths of qgroup self testsLinux
- CVE-2022-49911netfilter: ipset: enforce documented limit to prevent allocating huge memoryLinux
- CVE-2022-49908Bluetooth: L2CAP: Fix memory leak in vhci_writeLinux
- CVE-2022-49907net: mdio: fix undefined behavior in bit shift for __mdiobus_registerLinux
- CVE-2022-49906ibmvnic: Free rwi on reset successLinux
- CVE-2022-49904net, neigh: Fix null-ptr-deref in neigh_table_clear()Linux
- CVE-2022-49903ipv6: fix WARNING in ip6_route_net_exit_late()Linux
- CVE-2022-49902block: Fix possible memory leak for rq_wb on add_disk failureLinux
- CVE-2022-49901blk-mq: Fix kmemleak in blk_mq_init_allocated_queueLinux
- CVE-2022-49900i2c: piix4: Fix adapter not be removed in piix4_remove()Linux
- CVE-2022-49896cxl/pmem: Fix cxl_pmem_region and cxl_memdev leakLinux
- CVE-2022-49895cxl/region: Fix decoder allocation crashLinux
- CVE-2022-49894cxl/region: Fix region HPA ordering validationLinux
- CVE-2022-49893cxl/region: Fix cxl_region leak, cleanup targets at region deleteLinux
- CVE-2022-49891tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()Linux
- CVE-2022-49890capabilities: fix potential memleak on error path from vfs_getxattr_alloc()Linux
- CVE-2022-49889ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()Linux
- CVE-2022-49888arm64: entry: avoid kprobe recursionLinux
- CVE-2022-49887media: meson: vdec: fix possible refcount leak in vdec_probe()Linux
- CVE-2022-49885ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()Linux
- CVE-2022-49881wifi: cfg80211: fix memory leak in query_regdb_file()Linux
- CVE-2022-49880ext4: fix warning in 'ext4_da_release_space'Linux
- CVE-2022-49879ext4: fix BUG_ON() when directory entry has invalid rec_lenLinux
- CVE-2022-49878bpf, verifier: Fix memory leak in array reallocation for stack stateLinux
- CVE-2022-49877bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queuesLinux
- CVE-2022-49876wifi: mac80211: fix general-protection-fault in ieee80211_subif_start_xmit()Linux
- CVE-2022-49875bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILELinux
- CVE-2022-49874HID: hyperv: fix possible memory leak in mousevsc_probe()Linux
- CVE-2022-49873bpf: Fix wrong reg type conversion in release_reference()Linux
- CVE-2022-49871net: tun: Fix memory leaks of napi_get_fragsLinux
- CVE-2022-49870capabilities: fix undefined behavior in bit shift for CAP_TO_MASKLinux
- CVE-2022-49869bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()Linux
- CVE-2022-49868phy: ralink: mt7621-pci: add sentinel to quirks tableLinux
- CVE-2022-49867net: wwan: iosm: fix memory leak in ipc_wwan_dellinkLinux
- CVE-2022-49866net: wwan: mhi: fix memory leak in mhi_mbim_dellinkLinux
- CVE-2022-49865ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to networkLinux
- CVE-2022-49864drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()Linux
- CVE-2022-49863can: af_can: fix NULL pointer dereference in can_rx_register()Linux
- CVE-2022-49862tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_headerLinux
- CVE-2022-49861dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()Linux
- CVE-2022-49860dmaengine: ti: k3-udma-glue: fix memory leak when register device failLinux
- CVE-2022-49859net: lapbether: fix issue of invalid opcode in lapbeth_open()Linux
- CVE-2022-49857net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init()Linux
- CVE-2022-49855net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfgLinux
- CVE-2022-49854mctp: Fix an error handling path in mctp_init()Linux
- CVE-2022-49853net: macvlan: fix memory leaks of macvlan_common_newlinkLinux
- CVE-2022-49852riscv: process: fix kernel info leakageLinux
- CVE-2022-49851riscv: fix reserved memory setupLinux
- CVE-2022-49850nilfs2: fix deadlock in nilfs_count_free_blocks()Linux
- CVE-2022-49849btrfs: fix match incorrectly in dev_args_match_deviceLinux
- CVE-2022-49848phy: qcom-qmp-combo: fix NULL-deref on runtime resumeLinux
- CVE-2022-49847net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unloadLinux
- CVE-2022-49845can: j1939: j1939_send_one(): fix missing CAN header initializationLinux
- CVE-2022-49841serial: imx: Add missing .thaw_noirq hookLinux
- CVE-2022-49839scsi: scsi_transport_sas: Fix error handling in sas_phy_add()Linux
- CVE-2022-49838sctp: clear out_curr if all frag chunks of current msg are prunedLinux
- CVE-2022-49837bpf: Fix memory leaks in __check_func_callLinux
- CVE-2022-49836siox: fix possible memory leak in siox_device_add()Linux
- CVE-2022-49835ALSA: hda: fix potential memleak in 'add_widget_node'Linux
- CVE-2022-49833btrfs: zoned: clone zoned device info when cloning a deviceLinux
- CVE-2022-49832pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_mapLinux
- CVE-2022-49831btrfs: zoned: initialize device's zone info for seedingLinux
- CVE-2022-49830drm/drv: Fix potential memory leak in drm_dev_init()Linux
- CVE-2022-49829drm/scheduler: fix fence ref countingLinux
- CVE-2022-49828hugetlbfs: don't delete error page from pagecacheLinux
- CVE-2022-49827drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()Linux
- CVE-2022-49825ata: libata-transport: fix error handling in ata_tport_add()Linux
- CVE-2022-49824ata: libata-transport: fix error handling in ata_tlink_add()Linux
- CVE-2022-49823ata: libata-transport: fix error handling in ata_tdev_add()Linux
- CVE-2022-49822cifs: Fix connections leak when tlink setup failedLinux
- CVE-2022-49821mISDN: fix possible memory leak in mISDN_dsp_element_register()Linux
- CVE-2022-49820mctp i2c: don't count unused / invalid keys for flow releaseLinux
- CVE-2022-49819octeon_ep: fix potential memory leak in octep_device_setup()Linux
- CVE-2022-49818mISDN: fix misuse of put_device() in mISDN_register_device()Linux
- CVE-2022-49817net: mhi: Fix memory leak in mhi_net_dellink()Linux
- CVE-2022-49815erofs: fix missing xas_retry() in fscache modeLinux
- CVE-2022-49813net: ena: Fix error handling in ena_init()Linux
- CVE-2022-49812bridge: switchdev: Fix memory leaks when changing VLAN protocolLinux
- CVE-2022-49811drbd: use after free in drbd_create_device()Linux
- CVE-2022-49810netfs: Fix missing xas_retry() calls in xarray iterationLinux
- CVE-2022-49809net/x25: Fix skb leak in x25_lapb_receive_frame()Linux
- CVE-2022-49808net: dsa: don't leak tagger-owned storage on switch driver unbindLinux
- CVE-2022-49807nvmet: fix a memory leak in nvmet_auth_set_keyLinux
- CVE-2022-49806net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start()Linux
- CVE-2022-49805net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init()Linux
- CVE-2022-49803netdevsim: Fix memory leak of nsim_dev->fa_cookieLinux
- CVE-2022-49802ftrace: Fix null pointer dereference in ftrace_add_mod()Linux
- CVE-2022-49801tracing: Fix memory leak in tracing_read_pipe()Linux
- CVE-2022-49800tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event()Linux
- CVE-2022-49799tracing: Fix wild-memory-access in register_synth_event()Linux
- CVE-2022-49798tracing: Fix race where eprobes can be called before the eventLinux
- CVE-2022-49797tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit()Linux
- CVE-2022-49796tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit()Linux
- CVE-2022-49795rethook: fix a potential memleak in rethook_alloc()Linux
- CVE-2022-49794iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()Linux
- CVE-2022-49793iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()Linux
- CVE-2022-49791io_uring: fix multishot accept request leaksLinux
- CVE-2022-49790Input: iforce - invert valid length check when fetching device IDsLinux
- CVE-2022-49788misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()Linux
- CVE-2022-49787mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()Linux
- CVE-2022-49786blk-cgroup: properly pin the parent in blkcg_css_onlineLinux
- CVE-2022-49785x86/sgx: Add overflow check in sgx_validate_offset_length()Linux
- CVE-2022-49784perf/x86/amd/uncore: Fix memory leak for events arrayLinux
- CVE-2022-49783x86/fpu: Drop fpregs lock before inheriting FPU permissionsLinux
- CVE-2022-49782perf: Improve missing SIGTRAP checkingLinux
- CVE-2022-49781perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttlingLinux
- CVE-2022-49780scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()Linux
- CVE-2022-49779kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace caseLinux
- CVE-2022-49778arm64/mm: fix incorrect file_map_count for non-leaf pmd/pudLinux
- CVE-2022-49777Input: i8042 - fix leaking of platform device on module removalLinux
- CVE-2022-49776macvlan: enforce a consistent minimal mtuLinux
- CVE-2022-49774KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign()Linux
- CVE-2022-49773drm/amd/display: Fix optc2_configure warning on dcn314Linux
- CVE-2022-49772ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()Linux
- CVE-2022-49771dm ioctl: fix misbehavior if list_versions races with module loadingLinux
- CVE-2022-49769gfs2: Check sb_bsize_shift after reading superblockLinux
- CVE-2022-497679p/trans_fd: always use O_NONBLOCK read/writeLinux
- CVE-2022-49766netlink: Bounds-check struct nlmsgerr creationLinux
- CVE-2022-49765net/9p: use a dedicated spinlock for trans_fdLinux
- CVE-2022-49764bpf: Prevent bpf program recursion for raw tracepoint probesLinux
- CVE-2022-49762ntfs: check overflow when iterating ATTR_RECORDsLinux
- CVE-2020-36790nvmet: fix a memory leakLinux
- CVE-2025-23245NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows a guest to accNVIDIA vGPU Software, Cloud Gaming
- CVE-2024-52979Elasticsearch Uncontrolled Resource Consumption vulnerabilityElasticsearch · org.elasticsearch:elasticsearch
- CVE-2024-11390Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSSElastic Kibana
- CVE-2025-25016Kibana Unrestricted Upload of FileElastic Kibana
- CVE-2025-37796wifi: at76c50x: fix use after free access in at76_disconnectLinux
- CVE-2025-37794wifi: mac80211: Purge vif txq in ieee80211_do_stop()Linux
- CVE-2025-37793ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()Linux
- CVE-2025-37792Bluetooth: btrtl: Prevent potential NULL dereferenceLinux
- CVE-2025-37788cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error pathLinux
- CVE-2025-37787net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registeredLinux
- CVE-2025-37786net: dsa: free routing table on probe failureLinux
- CVE-2025-37784net: ti: icss-iep: Fix possible NULL pointer dereference for perout requestLinux
- CVE-2025-37783drm/msm/dpu: Fix error pointers in dpu_plane_virtual_atomic_checkLinux
- CVE-2025-37781i2c: cros-ec-tunnel: defer probe if parent EC is not presentLinux
- CVE-2025-37780isofs: Prevent the use of too small fidLinux
- CVE-2025-37775ksmbd: fix the warning from __kernel_write_iterLinux
- CVE-2025-37773virtiofs: add filesystem context source name checkLinux
- CVE-2025-37772RDMA/cma: Fix workqueue crash in cma_netevent_work_handlerLinux
- CVE-2025-37771drm/amd/pm: Prevent division by zeroLinux
- CVE-2025-37770drm/amd/pm: Prevent division by zeroLinux
- CVE-2025-37769drm/amd/pm/smu11: Prevent division by zeroLinux
- CVE-2025-37768drm/amd/pm: Prevent division by zeroLinux
- CVE-2025-37767drm/amd/pm: Prevent division by zeroLinux
- CVE-2025-37766drm/amd/pm: Prevent division by zeroLinux
- CVE-2025-37764drm/imagination: fix firmware memory leaksLinux
- CVE-2025-37762drm/virtio: Fix missed dmabuf unpinning in error path of prepare_fb()Linux
- CVE-2025-37760mm/vma: add give_up_on_oom option on modify/merge, use in uffd releaseLinux
- CVE-2024-11994APM Server Insertion of Sensitive Information into Log FileElastic APM Server
- CVE-2024-52976Elastic Agent Inclusion of Functionality from Untrusted Control SphereElastic Agent
- CVE-2023-46669Elastic Agent / Elastic Endpoint Security local API key disclosureElastic Agent and Elastic Defend
- CVE-2025-37759ublk: fix handling recovery & reissue in ublk_abort_queue()Linux
- CVE-2025-37758ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()Linux
- CVE-2025-37754drm/i915/huc: Fix fence not released on early probe errorsLinux
- CVE-2025-37748iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_groupLinux
- CVE-2025-37747perf: Fix hang while freeing sigtrap eventLinux
- CVE-2025-37746perf/dwc_pcie: fix duplicate pci_dev devicesLinux
- CVE-2025-37745PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()Linux
- CVE-2025-37744wifi: ath12k: fix memory leak in ath12k_pci_remove()Linux
- CVE-2025-37743wifi: ath12k: Avoid memory leak while enabling statisticsLinux
- CVE-2025-37742jfs: Fix uninit-value access of imap allocated in the diMount() functionLinux
- CVE-2025-37740jfs: add sanity check for agwidth in dbMountLinux
- CVE-2025-37739f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()Linux
- CVE-2025-23163net: vlan: don't propagate flags on openLinux
- CVE-2025-23162drm/xe/vf: Don't try to trigger a full GT reset if VFLinux
- CVE-2025-23161PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t typeLinux
- CVE-2025-23160media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initializationLinux
- CVE-2025-23154io_uring/net: fix io_req_post_cqe abuse by send bundleLinux
- CVE-2025-23153arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()Linux
- CVE-2025-23152arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()Linux
- CVE-2025-23149tpm: do not start chip while suspendedLinux
- CVE-2025-23148soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()Linux
- CVE-2025-23147i3c: Add NULL pointer check in i3c_master_queue_ibi()Linux
- CVE-2025-23146mfd: ene-kb3930: Fix a potential NULL pointer dereferenceLinux
- CVE-2025-23144backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()Linux
- CVE-2025-23143net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.Linux
- CVE-2025-23140misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq errorLinux
- CVE-2025-4164PHPGurukul Employee Record Management System changepassword.php sql injectionPHPGurukul Employee Record Management System
- CVE-2025-4163PHPGurukul Land Record System aboutus.php sql injectionPHPGurukul Land Record System
- CVE-2025-3890WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemra13 Simple Shopping Cart
- CVE-2025-3874WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Referencemra13 Simple Shopping Cart
- CVE-2025-3889WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'mra13 Simple Shopping Cart
- CVE-2025-1529AM LottiePlayer <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie Filejohanaarstein AM LottiePlayer
- CVE-2025-4162PCMan FTP Server ASCII Command buffer overflowPCMan FTP Server
- CVE-2025-4161PCMan FTP Server VERBOSE Command buffer overflowPCMan FTP Server
- CVE-2025-4160PCMan FTP Server LS Command buffer overflowPCMan FTP Server
- CVE-2025-4159PCMan FTP Server GLOB Command buffer overflowPCMan FTP Server
- CVE-2025-4158PCMan FTP Server PROMPT Command buffer overflowPCMan FTP Server
- CVE-2025-4157PHPGurukul Boat Booking System booking-details.php sql injectionPHPGurukul Boat Booking System
- CVE-2025-4156PHPGurukul Boat Booking System change-image.php sql injectionPHPGurukul Boat Booking System
- CVE-2025-4155PHPGurukul Boat Booking System edit-boat.php sql injectionPHPGurukul Boat Booking System
- CVE-2025-4154PHPGurukul Pre-School Enrollment System enrollment-details.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-3521Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpspeedo Team Members Showcase
- CVE-2025-4100Nautic Pages <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodestur Nautic Pages
- CVE-2025-4153PHPGurukul Park Ticketing Management System profile.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-4152PHPGurukul Online Birth Certificate System bwdates-reports-details.php sql injectionPHPGurukul Online Birth Certificate System
- CVE-2025-3504WP Maps < 4.7.2 - Admin+ Stored XSSWP Maps
- CVE-2025-3503WP Maps < 4.7.2 - Admin+ Stored XSSWP Maps
- CVE-2025-3502WP Maps < 4.7.2 - Admin+ Stored XSSWP Maps
- CVE-2024-13381Calculated Fields Form < 5.2.62 - Admin+ Stored XSSCalculated Fields Form
- CVE-2025-4151PHPGurukul Curfew e-Pass Management System pass-bwdates-reports-details.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2024-13845Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via WebhookGravity Forms WebHooks
- CVE-2025-4099List Children <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetheandystratton List Children
- CVE-2025-2168Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Updatebdthemes Ultimate Store Kit – Addon For WooCommerce, EDD an…
- CVE-2025-4144PKCE bypass via downgrade attackworkers-oauth-provider · @cloudflare/workers-oauth-provider
- CVE-2025-4143Missing validation of redirect_uri on authorize endpointworkers-oauth-provider · @cloudflare/workers-oauth-provider
- CVE-2024-48906Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.
- CVE-2025-32881An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.
- CVE-2025-32882An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.
- CVE-2025-32884An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12.
- CVE-2025-32885An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.
- CVE-2025-32886An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.
- CVE-2025-32890An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12.
- CVE-2025-44835D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbit
- CVE-2025-44836TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via t
- CVE-2025-44837TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck func
- CVE-2025-44838TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via th
- CVE-2025-44839TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function
- CVE-2025-44840TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function
- CVE-2025-44841TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function
- CVE-2025-44842TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port para
- CVE-2025-44843TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function
- CVE-2025-44844TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName
- CVE-2025-44845TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostT
- CVE-2025-44846TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUr
- CVE-2025-44847TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlan
- CVE-2025-44848TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url param
- CVE-2025-44854TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName
- CVE-2025-44860TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port param
- CVE-2025-44861TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function v
- CVE-2025-44862TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl
- CVE-2025-44863TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parame
- CVE-2025-44864Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter.
- CVE-2025-44865Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter.
- CVE-2025-44866Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter.
- CVE-2025-44867Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter
- CVE-2025-46629Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform
- CVE-2025-46630Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable '
- CVE-2025-46631Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable t
- CVE-2025-46632Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information
- CVE-2025-47153Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.dDebian trixie