# CVEs published 2025-05-01

372 CVEs were published on May 1, 2025: 10 critical, 85 high. Days are UTC.

- [CVE-2025-4185](https://cve.now/CVE-2025-4185.md): Wangshen SecGate 3600 g=obj\_area\_export\_save path traversal (CVSS 5.3, Wangshen SecGate)
- [CVE-2025-4184](https://cve.now/CVE-2025-4184.md): PCMan FTP Server QUOTE Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4183](https://cve.now/CVE-2025-4183.md): PCMan FTP Server RECV Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4182](https://cve.now/CVE-2025-4182.md): PCMan FTP Server BELL Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4181](https://cve.now/CVE-2025-4181.md): PCMan FTP Server SEND Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2024-52903](https://cve.now/CVE-2024-52903.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-1333](https://cve.now/CVE-2025-1333.md): IBM MQ Operator information disclosure (CVSS 6.0, IBM MQ Operator)
- [CVE-2025-4180](https://cve.now/CVE-2025-4180.md): PCMan FTP Server TRACE Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4178](https://cve.now/CVE-2025-4178.md): xiaowei1118 java\_server File Upload API FoodController.java path traversal (CVSS 5.3, xiaowei1118 java\_server)
- [CVE-2025-4176](https://cve.now/CVE-2025-4176.md): PHPGurukul Blood Bank & Donor Management System request-received-bydonar.php sql injection (CVSS 6.9, PHPGurukul Blood Bank & Donor Management System)
- [CVE-2025-27365](https://cve.now/CVE-2025-27365.md): IBM MQ Operator denial of service (CVSS 6.5, IBM MQ Operator)
- [CVE-2025-43595](https://cve.now/CVE-2025-43595.md): MSP360 Backup (for Linux) insecure filesystem permissions (CVSS 8.5, MSP360 Backup)
- [CVE-2025-4175](https://cve.now/CVE-2025-4175.md): AlanBinu007 Spring-Boot-Advanced-Projects Upload Profile API Endpoint UserProfileController.java uploadUserProfileImage path traversal (CVSS 5.3, AlanBinu007 Spring-Boot-Advanced-Projects)
- [CVE-2025-46569](https://cve.now/CVE-2025-46569.md): OPA server Data API HTTP path injection of Rego (CVSS 7.4, open-policy-agent opa · github.com/open-policy-agent/opa… +2)
- [CVE-2025-4174](https://cve.now/CVE-2025-4174.md): PHPGurukul COVID19 Testing Management System login.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-36558](https://cve.now/CVE-2025-36558.md): KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page (CVSS 6.1, KUNBUS Revolution Pi PiCtory)
- [CVE-2025-35996](https://cve.now/CVE-2025-35996.md): KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page (CVSS 9.0, KUNBUS Revolution Pi PiCtory)
- [CVE-2025-32011](https://cve.now/CVE-2025-32011.md): KUNBUS Revolution Pi Authentication Bypass by Primary Weakness (CVSS 9.8, KUNBUS Revolution Pi PiCtory)
- [CVE-2025-24522](https://cve.now/CVE-2025-24522.md): KUNBUS Revolution Pi Authentication Bypass by Primary Weakness (CVSS 10.0, KUNBUS Revolution Pi OS Bookworm)
- [CVE-2025-36521](https://cve.now/CVE-2025-36521.md): MicroDicom DICOM Viewer Out-of-bounds Read (CVSS 8.8, MicroDicom DICOM Viewer)
- [CVE-2025-3517](https://cve.now/CVE-2025-3517.md): Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a prev (CVSS 6.3, Devolutions Server)
- [CVE-2025-35975](https://cve.now/CVE-2025-35975.md): MicroDicom DICOM Viewer Out-of-bounds Write (CVSS 8.8, MicroDicom DICOM Viewer)
- [CVE-2025-46568](https://cve.now/CVE-2025-46568.md): Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability (CVSS 7.7, Stirling-Tools Stirling-PDF)
- [CVE-2025-46567](https://cve.now/CVE-2025-46567.md): LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy\_baichuan2.py (CVSS 6.1, hiyouga LLaMA-Factory · llamafactory)
- [CVE-2025-46566](https://cve.now/CVE-2025-46566.md): Dataease redshift JDBC Connection Remote Code Execution (CVSS 6.8, dataease)
- [CVE-2025-46565](https://cve.now/CVE-2025-46565.md): Vite's server.fs.deny bypassed with /. for files under project root (CVSS 6.0, vitejs vite · vite)
- [CVE-2025-46345](https://cve.now/CVE-2025-46345.md): Auth0 Account Link Extension JWT Invalid Signature Validation (CVSS 6.9, auth0-extensions auth0-account-link-extension)
- [CVE-2025-46337](https://cve.now/CVE-2025-46337.md): SQL injection in ADOdb PostgreSQL driver pg\_insert\_id() method (CVSS 10.0, ADOdb · adodb/adodb-php)
- [CVE-2025-4173](https://cve.now/CVE-2025-4173.md): SourceCodester Online Eyewear Shop Master.php delete\_cart sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2025-23246](https://cve.now/CVE-2025-23246.md): NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows a guest to con (CVSS 5.5, NVIDIA vGPU Software, Cloud Gaming)
- [CVE-2022-49931](https://cve.now/CVE-2022-49931.md): IB/hfi1: Correctly move list in sc\_disable() (CVSS 8.8, Linux)
- [CVE-2022-49930](https://cve.now/CVE-2022-49930.md): RDMA/hns: Fix NULL pointer problem in free\_mr\_init() (CVSS 5.5, Linux)
- [CVE-2022-49929](https://cve.now/CVE-2022-49929.md): RDMA/rxe: Fix mr leak in RESPST\_ERR\_RNR (no CVSS, Linux)
- [CVE-2022-49928](https://cve.now/CVE-2022-49928.md): SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed (CVSS 7.5, Linux)
- [CVE-2022-49927](https://cve.now/CVE-2022-49927.md): nfs4: Fix kmemleak when allocate slot failed (CVSS 5.5, Linux)
- [CVE-2022-49926](https://cve.now/CVE-2022-49926.md): net: dsa: Fix possible memory leaks in dsa\_loop\_init() (CVSS 5.5, Linux)
- [CVE-2022-49925](https://cve.now/CVE-2022-49925.md): RDMA/core: Fix null-ptr-deref in ib\_core\_cleanup() (CVSS 5.5, Linux)
- [CVE-2022-49924](https://cve.now/CVE-2022-49924.md): nfc: fdp: Fix potential memory leak in fdp\_nci\_send() (CVSS 5.5, Linux)
- [CVE-2022-49923](https://cve.now/CVE-2022-49923.md): nfc: nxp-nci: Fix potential memory leak in nxp\_nci\_send() (CVSS 5.5, Linux)
- [CVE-2022-49922](https://cve.now/CVE-2022-49922.md): nfc: nfcmrvl: Fix potential memory leak in nfcmrvl\_i2c\_nci\_send() (CVSS 5.5, Linux)
- [CVE-2022-49921](https://cve.now/CVE-2022-49921.md): net: sched: Fix use after free in red\_enqueue() (CVSS 7.8, Linux)
- [CVE-2022-49920](https://cve.now/CVE-2022-49920.md): netfilter: nf\_tables: netlink notifier might race to release objects (CVSS 7.8, Linux)
- [CVE-2022-49919](https://cve.now/CVE-2022-49919.md): netfilter: nf\_tables: release flow rule object from commit path (CVSS 7.8, Linux)
- [CVE-2022-49918](https://cve.now/CVE-2022-49918.md): ipvs: fix WARNING in \_\_ip\_vs\_cleanup\_batch() (no CVSS, Linux)
- [CVE-2022-49917](https://cve.now/CVE-2022-49917.md): ipvs: fix WARNING in ip\_vs\_app\_net\_cleanup() (no CVSS, Linux)
- [CVE-2022-49916](https://cve.now/CVE-2022-49916.md): rose: Fix NULL pointer dereference in rose\_send\_frame() (CVSS 5.5, Linux)
- [CVE-2022-49915](https://cve.now/CVE-2022-49915.md): mISDN: fix possible memory leak in mISDN\_register\_device() (CVSS 5.5, Linux)
- [CVE-2022-49914](https://cve.now/CVE-2022-49914.md): btrfs: fix inode list leak during backref walking at resolve\_indirect\_refs() (no CVSS, Linux)
- [CVE-2022-49913](https://cve.now/CVE-2022-49913.md): btrfs: fix inode list leak during backref walking at find\_parent\_nodes() (no CVSS, Linux)
- [CVE-2022-49912](https://cve.now/CVE-2022-49912.md): btrfs: fix ulist leaks in error paths of qgroup self tests (no CVSS, Linux)
- [CVE-2022-49911](https://cve.now/CVE-2022-49911.md): netfilter: ipset: enforce documented limit to prevent allocating huge memory (no CVSS, Linux)
- [CVE-2022-49910](https://cve.now/CVE-2022-49910.md): Bluetooth: L2CAP: Fix use-after-free caused by l2cap\_reassemble\_sdu (CVSS 8.8, Linux)
- [CVE-2022-49908](https://cve.now/CVE-2022-49908.md): Bluetooth: L2CAP: Fix memory leak in vhci\_write (CVSS 5.5, Linux)
- [CVE-2022-49907](https://cve.now/CVE-2022-49907.md): net: mdio: fix undefined behavior in bit shift for \_\_mdiobus\_register (no CVSS, Linux)
- [CVE-2022-49906](https://cve.now/CVE-2022-49906.md): ibmvnic: Free rwi on reset success (CVSS 5.5, Linux)
- [CVE-2022-49905](https://cve.now/CVE-2022-49905.md): net/smc: Fix possible leaked pernet namespace in smc\_init() (CVSS 7.8, Linux)
- [CVE-2022-49904](https://cve.now/CVE-2022-49904.md): net, neigh: Fix null-ptr-deref in neigh\_table\_clear() (CVSS 5.5, Linux)
- [CVE-2022-49903](https://cve.now/CVE-2022-49903.md): ipv6: fix WARNING in ip6\_route\_net\_exit\_late() (no CVSS, Linux)
- [CVE-2022-49902](https://cve.now/CVE-2022-49902.md): block: Fix possible memory leak for rq\_wb on add\_disk failure (CVSS 5.5, Linux)
- [CVE-2022-49901](https://cve.now/CVE-2022-49901.md): blk-mq: Fix kmemleak in blk\_mq\_init\_allocated\_queue (CVSS 5.5, Linux)
- [CVE-2022-49900](https://cve.now/CVE-2022-49900.md): i2c: piix4: Fix adapter not be removed in piix4\_remove() (no CVSS, Linux)
- [CVE-2022-49899](https://cve.now/CVE-2022-49899.md): fscrypt: stop using keyrings subsystem for fscrypt\_master\_key (CVSS 7.8, Linux)
- [CVE-2022-49898](https://cve.now/CVE-2022-49898.md): btrfs: fix tree mod log mishandling of reallocated nodes (CVSS 7.8, Linux)
- [CVE-2022-49896](https://cve.now/CVE-2022-49896.md): cxl/pmem: Fix cxl\_pmem\_region and cxl\_memdev leak (CVSS 5.5, Linux)
- [CVE-2022-49895](https://cve.now/CVE-2022-49895.md): cxl/region: Fix decoder allocation crash (CVSS 5.5, Linux)
- [CVE-2022-49894](https://cve.now/CVE-2022-49894.md): cxl/region: Fix region HPA ordering validation (CVSS 5.5, Linux)
- [CVE-2022-49893](https://cve.now/CVE-2022-49893.md): cxl/region: Fix cxl\_region leak, cleanup targets at region delete (no CVSS, Linux)
- [CVE-2022-49892](https://cve.now/CVE-2022-49892.md): ftrace: Fix use-after-free for dynamic ftrace\_ops (CVSS 7.8, Linux)
- [CVE-2022-49891](https://cve.now/CVE-2022-49891.md): tracing: kprobe: Fix memory leak in test\_gen\_kprobe/kretprobe\_cmd() (CVSS 5.5, Linux)
- [CVE-2022-49890](https://cve.now/CVE-2022-49890.md): capabilities: fix potential memleak on error path from vfs\_getxattr\_alloc() (CVSS 5.5, Linux)
- [CVE-2022-49889](https://cve.now/CVE-2022-49889.md): ring-buffer: Check for NULL cpu\_buffer in ring\_buffer\_wake\_waiters() (CVSS 5.5, Linux)
- [CVE-2022-49888](https://cve.now/CVE-2022-49888.md): arm64: entry: avoid kprobe recursion (no CVSS, Linux)
- [CVE-2022-49887](https://cve.now/CVE-2022-49887.md): media: meson: vdec: fix possible refcount leak in vdec\_probe() (CVSS 5.5, Linux)
- [CVE-2022-49886](https://cve.now/CVE-2022-49886.md): x86/tdx: Panic on bad configs that #VE on "private" memory access (CVSS 8.4, Linux)
- [CVE-2022-49885](https://cve.now/CVE-2022-49885.md): ACPI: APEI: Fix integer overflow in ghes\_estatus\_pool\_init() (CVSS 5.5, Linux)
- [CVE-2022-49884](https://cve.now/CVE-2022-49884.md): KVM: Initialize gfn\_to\_pfn\_cache locks in dedicated helper (CVSS 7.8, Linux)
- [CVE-2022-49883](https://cve.now/CVE-2022-49883.md): KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format (CVSS 7.1, Linux)
- [CVE-2022-49882](https://cve.now/CVE-2022-49882.md): KVM: Reject attempts to consume or refresh inactive gfn\_to\_pfn\_cache (CVSS 7.8, Linux)
- [CVE-2022-49881](https://cve.now/CVE-2022-49881.md): wifi: cfg80211: fix memory leak in query\_regdb\_file() (CVSS 5.5, Linux)
- [CVE-2022-49880](https://cve.now/CVE-2022-49880.md): ext4: fix warning in 'ext4\_da\_release\_space' (CVSS 5.5, Linux)
- [CVE-2022-49879](https://cve.now/CVE-2022-49879.md): ext4: fix BUG\_ON() when directory entry has invalid rec\_len (no CVSS, Linux)
- [CVE-2022-49878](https://cve.now/CVE-2022-49878.md): bpf, verifier: Fix memory leak in array reallocation for stack state (CVSS 5.5, Linux)
- [CVE-2022-49877](https://cve.now/CVE-2022-49877.md): bpf, sockmap: Fix the sk-\>sk\_forward\_alloc warning of sk\_stream\_kill\_queues (no CVSS, Linux)
- [CVE-2022-49876](https://cve.now/CVE-2022-49876.md): wifi: mac80211: fix general-protection-fault in ieee80211\_subif\_start\_xmit() (CVSS 5.5, Linux)
- [CVE-2022-49875](https://cve.now/CVE-2022-49875.md): bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE (CVSS 5.5, Linux)
- [CVE-2022-49874](https://cve.now/CVE-2022-49874.md): HID: hyperv: fix possible memory leak in mousevsc\_probe() (CVSS 5.5, Linux)
- [CVE-2022-49873](https://cve.now/CVE-2022-49873.md): bpf: Fix wrong reg type conversion in release\_reference() (CVSS 5.5, Linux)
- [CVE-2022-49872](https://cve.now/CVE-2022-49872.md): net: gso: fix panic on frag\_list with mixed head alloc types (CVSS 7.5, Linux)
- [CVE-2022-49871](https://cve.now/CVE-2022-49871.md): net: tun: Fix memory leaks of napi\_get\_frags (CVSS 5.5, Linux)
- [CVE-2022-49870](https://cve.now/CVE-2022-49870.md): capabilities: fix undefined behavior in bit shift for CAP\_TO\_MASK (no CVSS, Linux)
- [CVE-2022-49869](https://cve.now/CVE-2022-49869.md): bnxt\_en: Fix possible crash in bnxt\_hwrm\_set\_coal() (CVSS 5.5, Linux)
- [CVE-2022-49868](https://cve.now/CVE-2022-49868.md): phy: ralink: mt7621-pci: add sentinel to quirks table (no CVSS, Linux)
- [CVE-2022-49867](https://cve.now/CVE-2022-49867.md): net: wwan: iosm: fix memory leak in ipc\_wwan\_dellink (CVSS 5.5, Linux)
- [CVE-2022-49866](https://cve.now/CVE-2022-49866.md): net: wwan: mhi: fix memory leak in mhi\_mbim\_dellink (CVSS 5.5, Linux)
- [CVE-2022-49865](https://cve.now/CVE-2022-49865.md): ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (no CVSS, Linux)
- [CVE-2022-49864](https://cve.now/CVE-2022-49864.md): drm/amdkfd: Fix NULL pointer dereference in svm\_migrate\_to\_ram() (CVSS 5.5, Linux)
- [CVE-2022-49863](https://cve.now/CVE-2022-49863.md): can: af\_can: fix NULL pointer dereference in can\_rx\_register() (CVSS 5.5, Linux)
- [CVE-2022-49862](https://cve.now/CVE-2022-49862.md): tipc: fix the msg-\>req tlv len check in tipc\_nl\_compat\_name\_table\_dump\_header (CVSS 5.5, Linux)
- [CVE-2022-49861](https://cve.now/CVE-2022-49861.md): dmaengine: mv\_xor\_v2: Fix a resource leak in mv\_xor\_v2\_remove() (CVSS 5.5, Linux)
- [CVE-2022-49860](https://cve.now/CVE-2022-49860.md): dmaengine: ti: k3-udma-glue: fix memory leak when register device fail (CVSS 5.5, Linux)
- [CVE-2022-49859](https://cve.now/CVE-2022-49859.md): net: lapbether: fix issue of invalid opcode in lapbeth\_open() (no CVSS, Linux)
- [CVE-2022-49858](https://cve.now/CVE-2022-49858.md): octeontx2-pf: Fix SQE threshold checking (CVSS 7.8, Linux)
- [CVE-2022-49857](https://cve.now/CVE-2022-49857.md): net: marvell: prestera: fix memory leak in prestera\_rxtx\_switch\_init() (CVSS 5.5, Linux)
- [CVE-2022-49855](https://cve.now/CVE-2022-49855.md): net: wwan: iosm: fix memory leak in ipc\_pcie\_read\_bios\_cfg (CVSS 5.5, Linux)
- [CVE-2022-49854](https://cve.now/CVE-2022-49854.md): mctp: Fix an error handling path in mctp\_init() (CVSS 5.5, Linux)
- [CVE-2022-49853](https://cve.now/CVE-2022-49853.md): net: macvlan: fix memory leaks of macvlan\_common\_newlink (CVSS 5.5, Linux)
- [CVE-2022-49852](https://cve.now/CVE-2022-49852.md): riscv: process: fix kernel info leakage (no CVSS, Linux)
- [CVE-2022-49851](https://cve.now/CVE-2022-49851.md): riscv: fix reserved memory setup (no CVSS, Linux)
- [CVE-2022-49850](https://cve.now/CVE-2022-49850.md): nilfs2: fix deadlock in nilfs\_count\_free\_blocks() (CVSS 5.5, Linux)
- [CVE-2022-49849](https://cve.now/CVE-2022-49849.md): btrfs: fix match incorrectly in dev\_args\_match\_device (no CVSS, Linux)
- [CVE-2022-49848](https://cve.now/CVE-2022-49848.md): phy: qcom-qmp-combo: fix NULL-deref on runtime resume (CVSS 5.5, Linux)
- [CVE-2022-49847](https://cve.now/CVE-2022-49847.md): net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload (no CVSS, Linux)
- [CVE-2022-49846](https://cve.now/CVE-2022-49846.md): udf: Fix a slab-out-of-bounds write bug in udf\_find\_entry() (CVSS 7.8, Linux)
- [CVE-2022-49845](https://cve.now/CVE-2022-49845.md): can: j1939: j1939\_send\_one(): fix missing CAN header initialization (CVSS 5.5, Linux)
- [CVE-2022-49844](https://cve.now/CVE-2022-49844.md): can: dev: fix skb drop check (CVSS 7.1, Linux)
- [CVE-2022-49842](https://cve.now/CVE-2022-49842.md): ASoC: core: Fix use-after-free in snd\_soc\_exit() (CVSS 7.8, Linux)
- [CVE-2022-49841](https://cve.now/CVE-2022-49841.md): serial: imx: Add missing .thaw\_noirq hook (no CVSS, Linux)
- [CVE-2022-49840](https://cve.now/CVE-2022-49840.md): bpf, test\_run: Fix alignment problem in bpf\_prog\_test\_run\_skb() (CVSS 7.8, Linux)
- [CVE-2022-49839](https://cve.now/CVE-2022-49839.md): scsi: scsi\_transport\_sas: Fix error handling in sas\_phy\_add() (CVSS 5.5, Linux)
- [CVE-2022-49838](https://cve.now/CVE-2022-49838.md): sctp: clear out\_curr if all frag chunks of current msg are pruned (no CVSS, Linux)
- [CVE-2022-49837](https://cve.now/CVE-2022-49837.md): bpf: Fix memory leaks in \_\_check\_func\_call (CVSS 5.5, Linux)
- [CVE-2022-49836](https://cve.now/CVE-2022-49836.md): siox: fix possible memory leak in siox\_device\_add() (no CVSS, Linux)
- [CVE-2022-49835](https://cve.now/CVE-2022-49835.md): ALSA: hda: fix potential memleak in 'add\_widget\_node' (no CVSS, Linux)
- [CVE-2022-49834](https://cve.now/CVE-2022-49834.md): nilfs2: fix use-after-free bug of ns\_writer on remount (CVSS 7.8, Linux)
- [CVE-2022-49833](https://cve.now/CVE-2022-49833.md): btrfs: zoned: clone zoned device info when cloning a device (no CVSS, Linux)
- [CVE-2022-49832](https://cve.now/CVE-2022-49832.md): pinctrl: devicetree: fix null pointer dereferencing in pinctrl\_dt\_to\_map (no CVSS, Linux)
- [CVE-2022-49831](https://cve.now/CVE-2022-49831.md): btrfs: zoned: initialize device's zone info for seeding (no CVSS, Linux)
- [CVE-2022-49830](https://cve.now/CVE-2022-49830.md): drm/drv: Fix potential memory leak in drm\_dev\_init() (no CVSS, Linux)
- [CVE-2022-49829](https://cve.now/CVE-2022-49829.md): drm/scheduler: fix fence ref counting (no CVSS, Linux)
- [CVE-2022-49828](https://cve.now/CVE-2022-49828.md): hugetlbfs: don't delete error page from pagecache (no CVSS, Linux)
- [CVE-2022-49827](https://cve.now/CVE-2022-49827.md): drm: Fix potential null-ptr-deref in drm\_vblank\_destroy\_worker() (no CVSS, Linux)
- [CVE-2022-49826](https://cve.now/CVE-2022-49826.md): ata: libata-transport: fix double ata\_host\_put() in ata\_tport\_add() (CVSS 7.8, Linux)
- [CVE-2022-49825](https://cve.now/CVE-2022-49825.md): ata: libata-transport: fix error handling in ata\_tport\_add() (no CVSS, Linux)
- [CVE-2022-49824](https://cve.now/CVE-2022-49824.md): ata: libata-transport: fix error handling in ata\_tlink\_add() (no CVSS, Linux)
- [CVE-2022-49823](https://cve.now/CVE-2022-49823.md): ata: libata-transport: fix error handling in ata\_tdev\_add() (no CVSS, Linux)
- [CVE-2022-49822](https://cve.now/CVE-2022-49822.md): cifs: Fix connections leak when tlink setup failed (no CVSS, Linux)
- [CVE-2022-49821](https://cve.now/CVE-2022-49821.md): mISDN: fix possible memory leak in mISDN\_dsp\_element\_register() (no CVSS, Linux)
- [CVE-2022-49820](https://cve.now/CVE-2022-49820.md): mctp i2c: don't count unused / invalid keys for flow release (no CVSS, Linux)
- [CVE-2022-49819](https://cve.now/CVE-2022-49819.md): octeon\_ep: fix potential memory leak in octep\_device\_setup() (no CVSS, Linux)
- [CVE-2022-49818](https://cve.now/CVE-2022-49818.md): mISDN: fix misuse of put\_device() in mISDN\_register\_device() (no CVSS, Linux)
- [CVE-2022-49817](https://cve.now/CVE-2022-49817.md): net: mhi: Fix memory leak in mhi\_net\_dellink() (no CVSS, Linux)
- [CVE-2022-49815](https://cve.now/CVE-2022-49815.md): erofs: fix missing xas\_retry() in fscache mode (no CVSS, Linux)
- [CVE-2022-49814](https://cve.now/CVE-2022-49814.md): kcm: close race conditions on sk\_receive\_queue (CVSS 7.8, Linux)
- [CVE-2022-49813](https://cve.now/CVE-2022-49813.md): net: ena: Fix error handling in ena\_init() (no CVSS, Linux)
- [CVE-2022-49812](https://cve.now/CVE-2022-49812.md): bridge: switchdev: Fix memory leaks when changing VLAN protocol (no CVSS, Linux)
- [CVE-2022-49811](https://cve.now/CVE-2022-49811.md): drbd: use after free in drbd\_create\_device() (no CVSS, Linux)
- [CVE-2022-49810](https://cve.now/CVE-2022-49810.md): netfs: Fix missing xas\_retry() calls in xarray iteration (no CVSS, Linux)
- [CVE-2022-49809](https://cve.now/CVE-2022-49809.md): net/x25: Fix skb leak in x25\_lapb\_receive\_frame() (no CVSS, Linux)
- [CVE-2022-49808](https://cve.now/CVE-2022-49808.md): net: dsa: don't leak tagger-owned storage on switch driver unbind (no CVSS, Linux)
- [CVE-2022-49807](https://cve.now/CVE-2022-49807.md): nvmet: fix a memory leak in nvmet\_auth\_set\_key (no CVSS, Linux)
- [CVE-2022-49806](https://cve.now/CVE-2022-49806.md): net: microchip: sparx5: Fix potential null-ptr-deref in sparx\_stats\_init() and sparx5\_start() (no CVSS, Linux)
- [CVE-2022-49805](https://cve.now/CVE-2022-49805.md): net: lan966x: Fix potential null-ptr-deref in lan966x\_stats\_init() (no CVSS, Linux)
- [CVE-2022-49804](https://cve.now/CVE-2022-49804.md): s390: avoid using global register for current\_stack\_pointer (CVSS 7.8, Linux)
- [CVE-2022-49803](https://cve.now/CVE-2022-49803.md): netdevsim: Fix memory leak of nsim\_dev-\>fa\_cookie (no CVSS, Linux)
- [CVE-2022-49802](https://cve.now/CVE-2022-49802.md): ftrace: Fix null pointer dereference in ftrace\_add\_mod() (no CVSS, Linux)
- [CVE-2022-49801](https://cve.now/CVE-2022-49801.md): tracing: Fix memory leak in tracing\_read\_pipe() (no CVSS, Linux)
- [CVE-2022-49800](https://cve.now/CVE-2022-49800.md): tracing: Fix memory leak in test\_gen\_synth\_cmd() and test\_empty\_synth\_event() (no CVSS, Linux)
- [CVE-2022-49799](https://cve.now/CVE-2022-49799.md): tracing: Fix wild-memory-access in register\_synth\_event() (no CVSS, Linux)
- [CVE-2022-49798](https://cve.now/CVE-2022-49798.md): tracing: Fix race where eprobes can be called before the event (no CVSS, Linux)
- [CVE-2022-49797](https://cve.now/CVE-2022-49797.md): tracing: kprobe: Fix potential null-ptr-deref on trace\_event\_file in kprobe\_event\_gen\_test\_exit() (no CVSS, Linux)
- [CVE-2022-49796](https://cve.now/CVE-2022-49796.md): tracing: kprobe: Fix potential null-ptr-deref on trace\_array in kprobe\_event\_gen\_test\_exit() (no CVSS, Linux)
- [CVE-2022-49795](https://cve.now/CVE-2022-49795.md): rethook: fix a potential memleak in rethook\_alloc() (no CVSS, Linux)
- [CVE-2022-49794](https://cve.now/CVE-2022-49794.md): iio: adc: at91\_adc: fix possible memory leak in at91\_adc\_allocate\_trigger() (no CVSS, Linux)
- [CVE-2022-49793](https://cve.now/CVE-2022-49793.md): iio: trigger: sysfs: fix possible memory leak in iio\_sysfs\_trig\_init() (no CVSS, Linux)
- [CVE-2022-49792](https://cve.now/CVE-2022-49792.md): iio: adc: mp2629: fix potential array out of bound access (CVSS 7.3, Linux)
- [CVE-2022-49791](https://cve.now/CVE-2022-49791.md): io\_uring: fix multishot accept request leaks (no CVSS, Linux)
- [CVE-2022-49790](https://cve.now/CVE-2022-49790.md): Input: iforce - invert valid length check when fetching device IDs (no CVSS, Linux)
- [CVE-2022-49789](https://cve.now/CVE-2022-49789.md): scsi: zfcp: Fix double free of FSF request when qdio send fails (CVSS 7.0, Linux)
- [CVE-2022-49788](https://cve.now/CVE-2022-49788.md): misc/vmw\_vmci: fix an infoleak in vmci\_host\_do\_receive\_datagram() (no CVSS, Linux)
- [CVE-2022-49787](https://cve.now/CVE-2022-49787.md): mmc: sdhci-pci: Fix possible memory leak caused by missing pci\_dev\_put() (no CVSS, Linux)
- [CVE-2022-49786](https://cve.now/CVE-2022-49786.md): blk-cgroup: properly pin the parent in blkcg\_css\_online (no CVSS, Linux)
- [CVE-2022-49785](https://cve.now/CVE-2022-49785.md): x86/sgx: Add overflow check in sgx\_validate\_offset\_length() (no CVSS, Linux)
- [CVE-2022-49784](https://cve.now/CVE-2022-49784.md): perf/x86/amd/uncore: Fix memory leak for events array (no CVSS, Linux)
- [CVE-2022-49783](https://cve.now/CVE-2022-49783.md): x86/fpu: Drop fpregs lock before inheriting FPU permissions (no CVSS, Linux)
- [CVE-2022-49782](https://cve.now/CVE-2022-49782.md): perf: Improve missing SIGTRAP checking (no CVSS, Linux)
- [CVE-2022-49781](https://cve.now/CVE-2022-49781.md): perf/x86/amd: Fix crash due to race between amd\_pmu\_enable\_all, perf NMI and throttling (no CVSS, Linux)
- [CVE-2022-49780](https://cve.now/CVE-2022-49780.md): scsi: target: tcm\_loop: Fix possible name leak in tcm\_loop\_setup\_hba\_bus() (no CVSS, Linux)
- [CVE-2022-49779](https://cve.now/CVE-2022-49779.md): kprobes: Skip clearing aggrprobe's post\_handler in kprobe-on-ftrace case (no CVSS, Linux)
- [CVE-2022-49778](https://cve.now/CVE-2022-49778.md): arm64/mm: fix incorrect file\_map\_count for non-leaf pmd/pud (no CVSS, Linux)
- [CVE-2022-49777](https://cve.now/CVE-2022-49777.md): Input: i8042 - fix leaking of platform device on module removal (no CVSS, Linux)
- [CVE-2022-49776](https://cve.now/CVE-2022-49776.md): macvlan: enforce a consistent minimal mtu (no CVSS, Linux)
- [CVE-2022-49775](https://cve.now/CVE-2022-49775.md): tcp: cdg: allow tcp\_cdg\_release() to be called multiple times (CVSS 7.8, Linux)
- [CVE-2022-49774](https://cve.now/CVE-2022-49774.md): KVM: x86/xen: Fix eventfd error handling in kvm\_xen\_eventfd\_assign() (no CVSS, Linux)
- [CVE-2022-49773](https://cve.now/CVE-2022-49773.md): drm/amd/display: Fix optc2\_configure warning on dcn314 (no CVSS, Linux)
- [CVE-2022-49772](https://cve.now/CVE-2022-49772.md): ALSA: usb-audio: Drop snd\_BUG\_ON() from snd\_usbmidi\_output\_open() (no CVSS, Linux)
- [CVE-2022-49771](https://cve.now/CVE-2022-49771.md): dm ioctl: fix misbehavior if list\_versions races with module loading (no CVSS, Linux)
- [CVE-2022-49770](https://cve.now/CVE-2022-49770.md): ceph: avoid putting the realm twice when decoding snaps fails (CVSS 9.8, Linux)
- [CVE-2022-49769](https://cve.now/CVE-2022-49769.md): gfs2: Check sb\_bsize\_shift after reading superblock (no CVSS, Linux)
- [CVE-2022-49768](https://cve.now/CVE-2022-49768.md): 9p: trans\_fd/p9\_conn\_cancel: drop client lock earlier (CVSS 7.5, Linux)
- [CVE-2022-49767](https://cve.now/CVE-2022-49767.md): 9p/trans\_fd: always use O\_NONBLOCK read/write (no CVSS, Linux)
- [CVE-2022-49766](https://cve.now/CVE-2022-49766.md): netlink: Bounds-check struct nlmsgerr creation (no CVSS, Linux)
- [CVE-2022-49765](https://cve.now/CVE-2022-49765.md): net/9p: use a dedicated spinlock for trans\_fd (no CVSS, Linux)
- [CVE-2022-49764](https://cve.now/CVE-2022-49764.md): bpf: Prevent bpf program recursion for raw tracepoint probes (no CVSS, Linux)
- [CVE-2022-49763](https://cve.now/CVE-2022-49763.md): ntfs: fix use-after-free in ntfs\_attr\_find() (CVSS 7.8, Linux)
- [CVE-2022-49762](https://cve.now/CVE-2022-49762.md): ntfs: check overflow when iterating ATTR\_RECORDs (no CVSS, Linux)
- [CVE-2020-36790](https://cve.now/CVE-2020-36790.md): nvmet: fix a memory leak (no CVSS, Linux)
- [CVE-2025-23254](https://cve.now/CVE-2025-23254.md): NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by loca (CVSS 8.8, NVIDIA TensorRT-LLM)
- [CVE-2025-23244](https://cve.now/CVE-2025-23244.md): NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. (CVSS 7.8, NVIDIA GPU Display Driver, vGPU Software, Cloud Gaming)
- [CVE-2025-23245](https://cve.now/CVE-2025-23245.md): NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows a guest to acc (CVSS 5.5, NVIDIA vGPU Software, Cloud Gaming)
- [CVE-2024-52979](https://cve.now/CVE-2024-52979.md): Elasticsearch Uncontrolled Resource Consumption vulnerability (CVSS 6.5, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-11390](https://cve.now/CVE-2024-11390.md): Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS (CVSS 5.4, Elastic Kibana)
- [CVE-2025-25016](https://cve.now/CVE-2025-25016.md): Kibana Unrestricted Upload of File (CVSS 4.3, Elastic Kibana)
- [CVE-2025-37796](https://cve.now/CVE-2025-37796.md): wifi: at76c50x: fix use after free access in at76\_disconnect (no CVSS, Linux)
- [CVE-2025-37794](https://cve.now/CVE-2025-37794.md): wifi: mac80211: Purge vif txq in ieee80211\_do\_stop() (no CVSS, Linux)
- [CVE-2025-37793](https://cve.now/CVE-2025-37793.md): ASoC: Intel: avs: Fix null-ptr-deref in avs\_component\_probe() (no CVSS, Linux)
- [CVE-2025-37792](https://cve.now/CVE-2025-37792.md): Bluetooth: btrtl: Prevent potential NULL dereference (no CVSS, Linux)
- [CVE-2025-37791](https://cve.now/CVE-2025-37791.md): ethtool: cmis\_cdb: use correct rpl size in ethtool\_cmis\_module\_poll() (CVSS 7.8, Linux)
- [CVE-2025-37790](https://cve.now/CVE-2025-37790.md): net: mctp: Set SOCK\_RCU\_FREE (CVSS 8.8, Linux)
- [CVE-2025-37789](https://cve.now/CVE-2025-37789.md): net: openvswitch: fix nested key length validation in the set() action (CVSS 7.8, Linux)
- [CVE-2025-37788](https://cve.now/CVE-2025-37788.md): cxgb4: fix memory leak in cxgb4\_init\_ethtool\_filters() error path (no CVSS, Linux)
- [CVE-2025-37787](https://cve.now/CVE-2025-37787.md): net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (no CVSS, Linux)
- [CVE-2025-37786](https://cve.now/CVE-2025-37786.md): net: dsa: free routing table on probe failure (no CVSS, Linux)
- [CVE-2025-37784](https://cve.now/CVE-2025-37784.md): net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (no CVSS, Linux)
- [CVE-2025-37783](https://cve.now/CVE-2025-37783.md): drm/msm/dpu: Fix error pointers in dpu\_plane\_virtual\_atomic\_check (no CVSS, Linux)
- [CVE-2025-37781](https://cve.now/CVE-2025-37781.md): i2c: cros-ec-tunnel: defer probe if parent EC is not present (no CVSS, Linux)
- [CVE-2025-37780](https://cve.now/CVE-2025-37780.md): isofs: Prevent the use of too small fid (no CVSS, Linux)
- [CVE-2025-37779](https://cve.now/CVE-2025-37779.md): lib/iov\_iter: fix to increase non slab folio refcount (CVSS 7.8, Linux)
- [CVE-2025-37778](https://cve.now/CVE-2025-37778.md): ksmbd: Fix dangling pointer in krb\_authenticate (CVSS 9.8, Linux)
- [CVE-2025-37777](https://cve.now/CVE-2025-37777.md): ksmbd: fix use-after-free in \_\_smb2\_lease\_break\_noti() (CVSS 8.8, Linux)
- [CVE-2025-37776](https://cve.now/CVE-2025-37776.md): ksmbd: fix use-after-free in smb\_break\_all\_levII\_oplock() (CVSS 8.8, Linux)
- [CVE-2025-37775](https://cve.now/CVE-2025-37775.md): ksmbd: fix the warning from \_\_kernel\_write\_iter (no CVSS, Linux)
- [CVE-2025-37774](https://cve.now/CVE-2025-37774.md): slab: ensure slab-\>obj\_exts is clear in a newly allocated slab page (CVSS 7.8, Linux)
- [CVE-2025-37773](https://cve.now/CVE-2025-37773.md): virtiofs: add filesystem context source name check (no CVSS, Linux)
- [CVE-2025-37772](https://cve.now/CVE-2025-37772.md): RDMA/cma: Fix workqueue crash in cma\_netevent\_work\_handler (no CVSS, Linux)
- [CVE-2025-37771](https://cve.now/CVE-2025-37771.md): drm/amd/pm: Prevent division by zero (no CVSS, Linux)
- [CVE-2025-37770](https://cve.now/CVE-2025-37770.md): drm/amd/pm: Prevent division by zero (no CVSS, Linux)
- [CVE-2025-37769](https://cve.now/CVE-2025-37769.md): drm/amd/pm/smu11: Prevent division by zero (no CVSS, Linux)
- [CVE-2025-37768](https://cve.now/CVE-2025-37768.md): drm/amd/pm: Prevent division by zero (no CVSS, Linux)
- [CVE-2025-37767](https://cve.now/CVE-2025-37767.md): drm/amd/pm: Prevent division by zero (no CVSS, Linux)
- [CVE-2025-37766](https://cve.now/CVE-2025-37766.md): drm/amd/pm: Prevent division by zero (no CVSS, Linux)
- [CVE-2025-37765](https://cve.now/CVE-2025-37765.md): drm/nouveau: prime: fix ttm\_bo\_delayed\_delete oops (CVSS 7.8, Linux)
- [CVE-2025-37764](https://cve.now/CVE-2025-37764.md): drm/imagination: fix firmware memory leaks (no CVSS, Linux)
- [CVE-2025-37763](https://cve.now/CVE-2025-37763.md): drm/imagination: take paired job reference (CVSS 7.8, Linux)
- [CVE-2025-37762](https://cve.now/CVE-2025-37762.md): drm/virtio: Fix missed dmabuf unpinning in error path of prepare\_fb() (no CVSS, Linux)
- [CVE-2025-37761](https://cve.now/CVE-2025-37761.md): drm/xe: Fix an out-of-bounds shift when invalidating TLB (CVSS 7.8, Linux)
- [CVE-2025-37760](https://cve.now/CVE-2025-37760.md): mm/vma: add give\_up\_on\_oom option on modify/merge, use in uffd release (no CVSS, Linux)
- [CVE-2024-11994](https://cve.now/CVE-2024-11994.md): APM Server Insertion of Sensitive Information into Log File (CVSS 5.7, Elastic APM Server)
- [CVE-2024-52976](https://cve.now/CVE-2024-52976.md): Elastic Agent Inclusion of Functionality from Untrusted Control Sphere (CVSS 4.4, Elastic Agent)
- [CVE-2023-46669](https://cve.now/CVE-2023-46669.md): Elastic Agent / Elastic Endpoint Security local API key disclosure (CVSS 6.2, Elastic Agent and Elastic Defend)
- [CVE-2025-37759](https://cve.now/CVE-2025-37759.md): ublk: fix handling recovery & reissue in ublk\_abort\_queue() (no CVSS, Linux)
- [CVE-2025-37758](https://cve.now/CVE-2025-37758.md): ata: pata\_pxa: Fix potential NULL pointer dereference in pxa\_ata\_probe() (no CVSS, Linux)
- [CVE-2025-37757](https://cve.now/CVE-2025-37757.md): tipc: fix memory leak in tipc\_link\_xmit (CVSS 7.5, Linux)
- [CVE-2025-37756](https://cve.now/CVE-2025-37756.md): net: tls: explicitly disallow disconnect (CVSS 7.8, Linux)
- [CVE-2025-37755](https://cve.now/CVE-2025-37755.md): net: libwx: handle page\_pool\_dev\_alloc\_pages error (CVSS 7.5, Linux)
- [CVE-2025-37754](https://cve.now/CVE-2025-37754.md): drm/i915/huc: Fix fence not released on early probe errors (no CVSS, Linux)
- [CVE-2025-37752](https://cve.now/CVE-2025-37752.md): net\_sched: sch\_sfq: move the limit validation (CVSS 7.8, Linux)
- [CVE-2025-37751](https://cve.now/CVE-2025-37751.md): x86/cpu: Avoid running off the end of an AMD erratum table (CVSS 7.1, Linux)
- [CVE-2025-37750](https://cve.now/CVE-2025-37750.md): smb: client: fix UAF in decryption with multichannel (CVSS 9.8, Linux)
- [CVE-2025-37749](https://cve.now/CVE-2025-37749.md): net: ppp: Add bound checking for skb data on ppp\_sync\_txmung (CVSS 8.2, Linux)
- [CVE-2025-37748](https://cve.now/CVE-2025-37748.md): iommu/mediatek: Fix NULL pointer deference in mtk\_iommu\_device\_group (no CVSS, Linux)
- [CVE-2025-37747](https://cve.now/CVE-2025-37747.md): perf: Fix hang while freeing sigtrap event (no CVSS, Linux)
- [CVE-2025-37746](https://cve.now/CVE-2025-37746.md): perf/dwc\_pcie: fix duplicate pci\_dev devices (no CVSS, Linux)
- [CVE-2025-37745](https://cve.now/CVE-2025-37745.md): PM: hibernate: Avoid deadlock in hibernate\_compressor\_param\_set() (no CVSS, Linux)
- [CVE-2025-37744](https://cve.now/CVE-2025-37744.md): wifi: ath12k: fix memory leak in ath12k\_pci\_remove() (no CVSS, Linux)
- [CVE-2025-37743](https://cve.now/CVE-2025-37743.md): wifi: ath12k: Avoid memory leak while enabling statistics (no CVSS, Linux)
- [CVE-2025-37742](https://cve.now/CVE-2025-37742.md): jfs: Fix uninit-value access of imap allocated in the diMount() function (no CVSS, Linux)
- [CVE-2025-37741](https://cve.now/CVE-2025-37741.md): jfs: Prevent copying of nlink with value 0 from disk inode (CVSS 7.8, Linux)
- [CVE-2025-37740](https://cve.now/CVE-2025-37740.md): jfs: add sanity check for agwidth in dbMount (no CVSS, Linux)
- [CVE-2025-37739](https://cve.now/CVE-2025-37739.md): f2fs: fix to avoid out-of-bounds access in f2fs\_truncate\_inode\_blocks() (no CVSS, Linux)
- [CVE-2025-37738](https://cve.now/CVE-2025-37738.md): ext4: ignore xattrs past end (CVSS 7.8, Linux)
- [CVE-2025-23163](https://cve.now/CVE-2025-23163.md): net: vlan: don't propagate flags on open (no CVSS, Linux)
- [CVE-2025-23162](https://cve.now/CVE-2025-23162.md): drm/xe/vf: Don't try to trigger a full GT reset if VF (no CVSS, Linux)
- [CVE-2025-23161](https://cve.now/CVE-2025-23161.md): PCI: vmd: Make vmd\_dev::cfg\_lock a raw\_spinlock\_t type (no CVSS, Linux)
- [CVE-2025-23160](https://cve.now/CVE-2025-23160.md): media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (no CVSS, Linux)
- [CVE-2025-23159](https://cve.now/CVE-2025-23159.md): media: venus: hfi: add a check to handle OOB in sfr region (CVSS 8.4, Linux)
- [CVE-2025-23158](https://cve.now/CVE-2025-23158.md): media: venus: hfi: add check to handle incorrect queue size (CVSS 7.8, Linux)
- [CVE-2025-23157](https://cve.now/CVE-2025-23157.md): media: venus: hfi\_parser: add check to avoid out of bound access (CVSS 7.8, Linux)
- [CVE-2025-23156](https://cve.now/CVE-2025-23156.md): media: venus: hfi\_parser: refactor hfi packet parsing logic (CVSS 7.8, Linux)
- [CVE-2025-23155](https://cve.now/CVE-2025-23155.md): net: stmmac: Fix accessing freed irq affinity\_hint (CVSS 7.1, Linux)
- [CVE-2025-23154](https://cve.now/CVE-2025-23154.md): io\_uring/net: fix io\_req\_post\_cqe abuse by send bundle (no CVSS, Linux)
- [CVE-2025-23153](https://cve.now/CVE-2025-23153.md): arm/crc-t10dif: fix use of out-of-scope array in crc\_t10dif\_arch() (no CVSS, Linux)
- [CVE-2025-23152](https://cve.now/CVE-2025-23152.md): arm64/crc-t10dif: fix use of out-of-scope array in crc\_t10dif\_arch() (no CVSS, Linux)
- [CVE-2025-23151](https://cve.now/CVE-2025-23151.md): bus: mhi: host: Fix race between unprepare and queue\_buf (CVSS 7.8, Linux)
- [CVE-2025-23150](https://cve.now/CVE-2025-23150.md): ext4: fix off-by-one error in do\_split (CVSS 7.8, Linux)
- [CVE-2025-23149](https://cve.now/CVE-2025-23149.md): tpm: do not start chip while suspended (no CVSS, Linux)
- [CVE-2025-23148](https://cve.now/CVE-2025-23148.md): soc: samsung: exynos-chipid: Add NULL pointer check in exynos\_chipid\_probe() (no CVSS, Linux)
- [CVE-2025-23147](https://cve.now/CVE-2025-23147.md): i3c: Add NULL pointer check in i3c\_master\_queue\_ibi() (no CVSS, Linux)
- [CVE-2025-23146](https://cve.now/CVE-2025-23146.md): mfd: ene-kb3930: Fix a potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2025-23145](https://cve.now/CVE-2025-23145.md): mptcp: fix NULL pointer in can\_accept\_new\_subflow (CVSS 7.5, Linux)
- [CVE-2025-23144](https://cve.now/CVE-2025-23144.md): backlight: led\_bl: Hold led\_access lock when calling led\_sysfs\_disable() (no CVSS, Linux)
- [CVE-2025-23143](https://cve.now/CVE-2025-23143.md): net: Fix null-ptr-deref by sock\_lock\_init\_class\_and\_name() and rmmod. (no CVSS, Linux)
- [CVE-2025-23142](https://cve.now/CVE-2025-23142.md): sctp: detect and prevent references to a freed transport in sendmsg (CVSS 7.8, Linux)
- [CVE-2025-23141](https://cve.now/CVE-2025-23141.md): KVM: x86: Acquire SRCU in KVM\_GET\_MP\_STATE to protect guest memory accesses (CVSS 7.8, Linux)
- [CVE-2025-23140](https://cve.now/CVE-2025-23140.md): misc: pci\_endpoint\_test: Avoid issue of interrupts remaining after request\_irq error (no CVSS, Linux)
- [CVE-2025-4164](https://cve.now/CVE-2025-4164.md): PHPGurukul Employee Record Management System changepassword.php sql injection (CVSS 6.9, PHPGurukul Employee Record Management System)
- [CVE-2025-4163](https://cve.now/CVE-2025-4163.md): PHPGurukul Land Record System aboutus.php sql injection (CVSS 5.3, PHPGurukul Land Record System)
- [CVE-2025-3890](https://cve.now/CVE-2025-3890.md): WordPress Simple PayPal Shopping Cart \<= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, mra13 Simple Shopping Cart)
- [CVE-2025-3874](https://cve.now/CVE-2025-3874.md): WordPress Simple PayPal Shopping Cart \<= 5.1.3 - Insecure Direct Object Reference (CVSS 6.5, mra13 Simple Shopping Cart)
- [CVE-2025-3889](https://cve.now/CVE-2025-3889.md): WordPress Simple PayPal Shopping Cart \<= 5.1.3 - Insecure Direct Object Reference via 'quantity' (CVSS 5.3, mra13 Simple Shopping Cart)
- [CVE-2025-1529](https://cve.now/CVE-2025-1529.md): AM LottiePlayer \<= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File (CVSS 6.4, johanaarstein AM LottiePlayer)
- [CVE-2025-4162](https://cve.now/CVE-2025-4162.md): PCMan FTP Server ASCII Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-27007](https://cve.now/CVE-2025-27007.md): WordPress SureTriggers \<= 1.0.82 - Privilege Escalation Vulnerability (CVSS 9.8, Brainstorm Force OttoKit)
- [CVE-2025-4161](https://cve.now/CVE-2025-4161.md): PCMan FTP Server VERBOSE Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4160](https://cve.now/CVE-2025-4160.md): PCMan FTP Server LS Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4159](https://cve.now/CVE-2025-4159.md): PCMan FTP Server GLOB Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4158](https://cve.now/CVE-2025-4158.md): PCMan FTP Server PROMPT Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4157](https://cve.now/CVE-2025-4157.md): PHPGurukul Boat Booking System booking-details.php sql injection (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2025-4156](https://cve.now/CVE-2025-4156.md): PHPGurukul Boat Booking System change-image.php sql injection (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2025-4155](https://cve.now/CVE-2025-4155.md): PHPGurukul Boat Booking System edit-boat.php sql injection (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2025-4154](https://cve.now/CVE-2025-4154.md): PHPGurukul Pre-School Enrollment System enrollment-details.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-3521](https://cve.now/CVE-2025-3521.md): Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder \<= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpspeedo Team Members Showcase)
- [CVE-2025-4100](https://cve.now/CVE-2025-4100.md): Nautic Pages \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stur Nautic Pages)
- [CVE-2025-4153](https://cve.now/CVE-2025-4153.md): PHPGurukul Park Ticketing Management System profile.php sql injection (CVSS 6.9, PHPGurukul Park Ticketing Management System)
- [CVE-2025-4152](https://cve.now/CVE-2025-4152.md): PHPGurukul Online Birth Certificate System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Online Birth Certificate System)
- [CVE-2025-3504](https://cve.now/CVE-2025-3504.md): WP Maps \< 4.7.2 - Admin+ Stored XSS (CVSS 3.5, WP Maps)
- [CVE-2025-3503](https://cve.now/CVE-2025-3503.md): WP Maps \< 4.7.2 - Admin+ Stored XSS (CVSS 4.5, WP Maps)
- [CVE-2025-3502](https://cve.now/CVE-2025-3502.md): WP Maps \< 4.7.2 - Admin+ Stored XSS (CVSS 3.5, WP Maps)
- [CVE-2024-13381](https://cve.now/CVE-2024-13381.md): Calculated Fields Form \< 5.2.62 - Admin+ Stored XSS (CVSS 3.5, Calculated Fields Form)
- [CVE-2025-4151](https://cve.now/CVE-2025-4151.md): PHPGurukul Curfew e-Pass Management System pass-bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-4150](https://cve.now/CVE-2025-4150.md): Netgear EX6200 sub\_54340 buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-3952](https://cve.now/CVE-2025-3952.md): Projectopia &#8211; WordPress Project Management \<= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion (CVSS 8.1, Projectopia – Project Management Tool)
- [CVE-2024-13845](https://cve.now/CVE-2024-13845.md): Gravity Forms WebHooks \<= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook (CVSS 5.5, Gravity Forms WebHooks)
- [CVE-2025-4099](https://cve.now/CVE-2025-4099.md): List Children \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, theandystratton List Children)
- [CVE-2025-4149](https://cve.now/CVE-2025-4149.md): Netgear EX6200 sub\_54014 buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-2168](https://cve.now/CVE-2025-2168.md): Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \<= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update (CVSS 4.3, bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD an…)
- [CVE-2025-1304](https://cve.now/CVE-2025-1304.md): NewsBlogger \<= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, spicethemes NewsBlogger)
- [CVE-2025-1305](https://cve.now/CVE-2025-1305.md): NewsBlogger \<= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation (CVSS 8.8, spicethemes NewsBlogger)
- [CVE-2025-4148](https://cve.now/CVE-2025-4148.md): Netgear EX6200 sub\_503FC buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-2816](https://cve.now/CVE-2025-2816.md): Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 8.1, a3rev Page View Count)
- [CVE-2025-4147](https://cve.now/CVE-2025-4147.md): Netgear EX6200 sub\_47F7C buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-4146](https://cve.now/CVE-2025-4146.md): Netgear EX6200 sub\_41940 buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2025-4144](https://cve.now/CVE-2025-4144.md): PKCE bypass via downgrade attack (CVSS 5.3, workers-oauth-provider · @cloudflare/workers-oauth-provider)
- [CVE-2025-4143](https://cve.now/CVE-2025-4143.md): Missing validation of redirect\_uri on authorize endpoint (CVSS 6.0, workers-oauth-provider · @cloudflare/workers-oauth-provider)
- [CVE-2025-4145](https://cve.now/CVE-2025-4145.md): Netgear EX6200 sub\_3D0BC buffer overflow (CVSS 8.7, Netgear EX6200)
- [CVE-2024-48905](https://cve.now/CVE-2024-48905.md): Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. (CVSS 9.1)
- [CVE-2024-48906](https://cve.now/CVE-2024-48906.md): Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name. (CVSS 6.1)
- [CVE-2024-48907](https://cve.now/CVE-2024-48907.md): Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API. (CVSS 7.5)
- [CVE-2025-32881](https://cve.now/CVE-2025-32881.md): An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. (CVSS 4.3)
- [CVE-2025-32882](https://cve.now/CVE-2025-32882.md): An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. (CVSS 5.3)
- [CVE-2025-32884](https://cve.now/CVE-2025-32884.md): An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. (CVSS 4.3)
- [CVE-2025-32885](https://cve.now/CVE-2025-32885.md): An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. (CVSS 6.5)
- [CVE-2025-32886](https://cve.now/CVE-2025-32886.md): An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. (CVSS 4.0)
- [CVE-2025-32887](https://cve.now/CVE-2025-32887.md): An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. (CVSS 7.1)
- [CVE-2025-32888](https://cve.now/CVE-2025-32888.md): An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. (CVSS 7.3)
- [CVE-2025-32889](https://cve.now/CVE-2025-32889.md): An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. (CVSS 7.3)
- [CVE-2025-32890](https://cve.now/CVE-2025-32890.md): An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. (CVSS 5.3)
- [CVE-2025-44835](https://cve.now/CVE-2025-44835.md): D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbit (CVSS 6.3)
- [CVE-2025-44836](https://cve.now/CVE-2025-44836.md): TOTOLINK CPE CP900 V6.3c.1144\_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via t (CVSS 6.3)
- [CVE-2025-44837](https://cve.now/CVE-2025-44837.md): TOTOLINK CPE CP900 V6.3c.1144\_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck func (CVSS 6.3)
- [CVE-2025-44838](https://cve.now/CVE-2025-44838.md): TOTOLINK CPE CP900 V6.3c.1144\_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via th (CVSS 6.3)
- [CVE-2025-44839](https://cve.now/CVE-2025-44839.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function (CVSS 6.5)
- [CVE-2025-44840](https://cve.now/CVE-2025-44840.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function (CVSS 6.5)
- [CVE-2025-44841](https://cve.now/CVE-2025-44841.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function (CVSS 6.5)
- [CVE-2025-44842](https://cve.now/CVE-2025-44842.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the msg\_process function via the Port para (CVSS 6.5)
- [CVE-2025-44843](https://cve.now/CVE-2025-44843.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function (CVSS 6.5)
- [CVE-2025-44844](https://cve.now/CVE-2025-44844.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName (CVSS 6.5)
- [CVE-2025-44845](https://cve.now/CVE-2025-44845.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostT (CVSS 6.5)
- [CVE-2025-44846](https://cve.now/CVE-2025-44846.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUr (CVSS 6.3)
- [CVE-2025-44847](https://cve.now/CVE-2025-44847.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlan (CVSS 6.3)
- [CVE-2025-44848](https://cve.now/CVE-2025-44848.md): TOTOLINK CA600-PoE V5.3c.6665\_B20180820 was found to contain a command injection vulnerability in the msg\_process function via the Url param (CVSS 6.5)
- [CVE-2025-44854](https://cve.now/CVE-2025-44854.md): TOTOLINK CP900 V6.3c.1144\_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName (CVSS 6.3)
- [CVE-2025-44860](https://cve.now/CVE-2025-44860.md): TOTOLINK CA300-POE V6.2c.884\_B20180522 was found to contain a command injection vulnerability in the msg\_process function via the Port param (CVSS 6.5)
- [CVE-2025-44861](https://cve.now/CVE-2025-44861.md): TOTOLINK CA300-POE V6.2c.884\_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function v (CVSS 6.3)
- [CVE-2025-44862](https://cve.now/CVE-2025-44862.md): TOTOLINK CA300-POE V6.2c.884\_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl (CVSS 6.3)
- [CVE-2025-44863](https://cve.now/CVE-2025-44863.md): TOTOLINK CA300-POE V6.2c.884\_B20180522 was found to contain a command injection vulnerability in the msg\_process function via the Url parame (CVSS 6.5)
- [CVE-2025-44864](https://cve.now/CVE-2025-44864.md): Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. (CVSS 6.3)
- [CVE-2025-44865](https://cve.now/CVE-2025-44865.md): Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. (CVSS 6.3)
- [CVE-2025-44866](https://cve.now/CVE-2025-44866.md): Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. (CVSS 6.3)
- [CVE-2025-44867](https://cve.now/CVE-2025-44867.md): Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter (CVSS 6.3)
- [CVE-2025-46625](https://cve.now/CVE-2025-46625.md): Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker tha (CVSS 8.8)
- [CVE-2025-46626](https://cve.now/CVE-2025-46626.md): Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 a (CVSS 7.3)
- [CVE-2025-46627](https://cve.now/CVE-2025-46627.md): Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calcula (CVSS 8.2)
- [CVE-2025-46628](https://cve.now/CVE-2025-46628.md): Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacke (CVSS 7.3)
- [CVE-2025-46629](https://cve.now/CVE-2025-46629.md): Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform (CVSS 6.5)
- [CVE-2025-46630](https://cve.now/CVE-2025-46630.md): Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable ' (CVSS 6.5)
- [CVE-2025-46631](https://cve.now/CVE-2025-46631.md): Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable t (CVSS 6.5)
- [CVE-2025-46632](https://cve.now/CVE-2025-46632.md): Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information (CVSS 6.5)
- [CVE-2025-46633](https://cve.now/CVE-2025-46633.md): Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt (CVSS 8.2)
- [CVE-2025-46634](https://cve.now/CVE-2025-46634.md): Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated a (CVSS 8.2)
- [CVE-2025-46635](https://cve.now/CVE-2025-46635.md): An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. (CVSS 7.1)
- [CVE-2025-47153](https://cve.now/CVE-2025-47153.md): Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs\_20.19.0+dfsg-2\_i386.d (CVSS 6.5, Debian trixie)
- [CVE-2025-47154](https://cve.now/CVE-2025-47154.md): LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments\_list references, leading to a use-after-free, and allow (CVSS 9.0, Ladybird)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.