CVEs published May 6, 2025
166 CVEs were published on May 6, 2025: 16 critical, 62 high.
- Published
- 166
- Critical
- 16
- High
- 62
- Medium
- 78
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Qualcomm Snapdragon
- 35
- Huawei HarmonyOS
- 11
- D-Link DIR-600L
- 9
- OpenHarmony
- 6
- TCMAN GIM
- 6
- Dell Storage Center - Dell Storage Manager
- 5
- MRCMS
- 5
- Crestron Automate VX
- 4
- itsourcecode Content Management System
- 4
- itsourcecode Gym Management System
- 4
Critical 16
- CVE-2025-0855PGS Core <= 5.8.0 - Unauthenticated PHP Object InjectionPotenza Global Solutions PGS Core
- CVE-2025-47419Non-Secure AccessCrestron Automate VX
- CVE-2025-46572passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrappingauth0 passport-wsfed-saml2 · passport-wsfed-saml2
- CVE-2024-12225Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypassquarkus · Red Hat build of Quarkus
- CVE-2025-46816goshs route not protected, allows command executionpatrickhener goshs · github.com/patrickhener/goshs
- CVE-2025-25014Kibana arbitrary code execution via prototype pollutionElastic Kibana
- CVE-2025-4041Use of Hard-coded Credentials Optigo Networks ONS NC600Optigo Networks ONS NC600
- CVE-2025-40625Multiple vulnerabilities in TCMAN's GIMTCMAN GIM
- CVE-2025-40624Multiple vulnerabilities in TCMAN's GIMTCMAN GIM
- CVE-2025-40623Multiple vulnerabilities in TCMAN's GIMTCMAN GIM
- CVE-2025-40622Multiple vulnerabilities in TCMAN's GIMTCMAN GIM
- CVE-2025-40621Multiple vulnerabilities in TCMAN's GIMTCMAN GIM
- CVE-2025-40620Multiple vulnerabilities in TCMAN's GIMTCMAN GIM
- CVE-2025-44073SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
- CVE-2025-44899There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the web url /goform/ WifiG
- CVE-2025-45491Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the userna
High 62
- CVE-2025-0856PGS Core <= 5.8.0 - Missing Authorization via Multiple FunctionsPotenza Global Solutions PGS Core
- CVE-2025-4372Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2025-47420User Permissions on Network APICrestron Automate VX
- CVE-2025-0853PGS Core <= 5.8.0 - Unauthenticated SQL InjectionPotenza Global Solutions PGS Core
- CVE-2025-46573passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smugglingauth0 passport-wsfed-saml2 · passport-wsfed-saml2
- CVE-2025-0649Stack Exhaustion In Tensorflow ServingGoogle Tensorflow
- CVE-2025-46820phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifactphpgt Dom
- CVE-2025-46815ZITADEL Allows IdP Intent Token Reusezitadel · github.com/zitadel/zitadel
- CVE-2025-30165Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configurationvllm-project vllm · vllm
- CVE-2025-22477Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability.Dell Storage Center - Dell Storage Manager
- CVE-2025-22478Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabDell Storage Center - Dell Storage Manager
- CVE-2025-4368Tenda AC8 MtuSetMacWan formGetRouterStatus buffer overflowTenda AC8
- CVE-2025-2898IBM Maximo Application Suite privilege escalationIBM Maximo Application Suite
- CVE-2025-4356Tenda DAP-1520 Authentication storage mod_graph_auth_uri_handler stack-based overflowTenda DAP-1520
- CVE-2025-4355Tenda DAP-1520 api set_ws_action heap-based overflowTenda DAP-1520
- CVE-2025-4354Tenda DAP-1520 storage check_dws_cookie stack-based overflowTenda DAP-1520
- CVE-2025-4350D-Link DIR-600L wake_on_lan command injectionD-Link DIR-600L
- CVE-2025-4349D-Link DIR-600L formSysCmd command injectionD-Link DIR-600L
- CVE-2025-0984Arbitrary File Upload in Netoloji Software's E-FlowNetoloji Software E-Flow
- CVE-2025-4348D-Link DIR-600L formSetWanL2TP buffer overflowD-Link DIR-600L
- CVE-2025-4347D-Link DIR-600L formWlSiteSurvey buffer overflowD-Link DIR-600L
- CVE-2025-4346D-Link DIR-600L formSetWAN_Wizard534 buffer overflowD-Link DIR-600L
- CVE-2025-4345D-Link DIR-600L formSetLog buffer overflowD-Link DIR-600L
- CVE-2025-4344D-Link DIR-600L formLogin buffer overflowD-Link DIR-600L
- CVE-2025-2011Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameteraverta Depicter — Popup & Slider Builder
- CVE-2025-46762Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadataApache Software Foundation Apache Parquet Java · org.apache…
- CVE-2025-4343D-Link DIR-600L formEasySetupWizard buffer overflowD-Link DIR-600L
- CVE-2025-21475Buffer Over-read in DisplayQualcomm Snapdragon
- CVE-2025-21470Improper Access Control in Camera DriverQualcomm Snapdragon
- CVE-2025-21469Improper Access Control in Camera DriverQualcomm Snapdragon
- CVE-2025-21468Out-of-bounds Write in Computer VisionQualcomm Snapdragon
- CVE-2025-21467Out-of-bounds Write in Computer VisionQualcomm Snapdragon
- CVE-2025-21462Out-of-bounds Write in Computer VisionQualcomm Snapdragon
- CVE-2025-21460Improper Input Validation in Automotive Software platform based on QNXQualcomm Snapdragon
- CVE-2025-21459Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2025-21453Use After Free in GPS HLOS DriverQualcomm Snapdragon
- CVE-2024-49847Buffer Over-read in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-49846Buffer Over-read in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-49845Improper Input Validation in HLOSQualcomm Snapdragon
- CVE-2024-49844Improper Input Validation in AutomotiveQualcomm Snapdragon
- CVE-2024-49842Improper Access Control in HypervisorQualcomm Snapdragon
- CVE-2024-49841Detection of Error Condition Without Action in HypervisorQualcomm Snapdragon
- CVE-2024-49835Out-of-bounds Write in SPS ApplicationsQualcomm Snapdragon
- CVE-2024-45579Improper Input Validation in Camera DriverQualcomm Snapdragon
- CVE-2024-45578Improper Validation of Array Index in Camera DriverQualcomm Snapdragon
- CVE-2024-45577Improper Input Validation in Camera DriverQualcomm Snapdragon
- CVE-2024-45576Improper Validation of Array Index in Camera DriverQualcomm Snapdragon
- CVE-2024-45575Integer Overflow or Wraparound in Camera DriverQualcomm Snapdragon
- CVE-2024-45574Improper Validation of Array Index in Camera DriverQualcomm Snapdragon
- CVE-2024-45567Use After Free in Camera DriverQualcomm Snapdragon
- CVE-2024-45566Use After Free in Camera DriverQualcomm Snapdragon
- CVE-2024-45565Time-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverQualcomm Snapdragon
- CVE-2024-45564Use After Free in HLOSQualcomm Snapdragon
- CVE-2024-45554Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2025-4342D-Link DIR-600L formEasySetupWizard3 buffer overflowD-Link DIR-600L
- CVE-2025-46585Out-of-bounds array read/write vulnerability in the kernel module Impact: Successful exploitation of this vulnerability may affect availabilHuawei HarmonyOS
- CVE-2025-46584Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerabilitHuawei HarmonyOS
- CVE-2025-2802LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode ExecutionLayoutBoxx
- CVE-2025-3610Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Updatepixel_prime Reales WP STPT
- CVE-2025-2509Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvGoogle ChromeOS
- CVE-2025-46728cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requestsyhirose cpp-httplib
- CVE-2025-4299Tenda AC1206 openSchedWifi setSchedWifi buffer overflowTenda AC1206
Medium, low and unrated 88
- CVE-2025-47418RecordingCrestron Automate VX
- CVE-2025-47417Enable Debug ImagesCrestron Automate VX
- CVE-2025-4388A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QLiferay Portal · Liferay DXP +1
- CVE-2025-37730Logstash Improper Certificate Validation in TCP outputElastic Logstash
- CVE-2025-46736Umbraco Makes User Enumeration Feasible Based on Timing of Login ResponseUmbraco-CMS · Umbraco.Cms
- CVE-2025-46735Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`nrkno terraform-provider-windns · github.com/nrkno/terrafor…
- CVE-2025-32022Finit has heap based buffer overwrite in urandom.so plugintroglobit finit
- CVE-2025-22476Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command Dell Storage Center - Dell Storage Manager
- CVE-2025-4384Certificate validity not properly verifiedarcinfo PcVue
- CVE-2025-22479Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Dell Storage Center - Dell Storage Manager
- CVE-2025-4363itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-23379Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Dell Storage Center - Dell Storage Manager
- CVE-2025-4362itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-46814FastAPI Guard Remote Header Injection via X-Forwarded-For Manipulationrennf93 fastapi-guard · fastapi-guard
- CVE-2025-4374Quay: incorrect privilege assignmentProject Quay quay · Red Hat Quay
- CVE-2025-4373Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unicharglib · Red Hat Enterprise Linux +2
- CVE-2025-4361PHPGurukul Company Visitor Management System department.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-4360itsourcecode Gym Management System view_member.php sql injectionitsourcecode Gym Management System
- CVE-2025-4359itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4358PHPGurukul Company Visitor Management System admin-profile.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-4357Tenda RX3 telnet command injectionTenda RX3
- CVE-2025-4353Brilliance Golden Link Secondary System queryTsDictionaryType.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-4352Brilliance Golden Link Secondary System tcEntrFlowSelect.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-3782Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametercyclonecode Cision Block
- CVE-2025-25052arkcompiler_ets_runtime has a buffer overflow vulnerabilityOpenHarmony
- CVE-2025-27241multimedia_av_codec has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-27248ai_neural_network_runtime has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-22886distributeddatamgr_udmf has a memory leak vulnerabilityOpenHarmony
- CVE-2025-27132arkcompiler_ets_runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-25218third_party_mksh has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2024-49830Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioQualcomm Snapdragon
- CVE-2024-49829Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in CameraQualcomm Snapdragon
- CVE-2024-45583Use After Free in Secure ProcessorQualcomm Snapdragon
- CVE-2024-45581Out-of-bounds Write in AudioQualcomm Snapdragon
- CVE-2024-45570Use of Out-of-range Pointer Offset in Camera DriverQualcomm Snapdragon
- CVE-2024-45568Buffer Over-read in Camera DriverQualcomm Snapdragon
- CVE-2024-45563Out-of-bounds Write in Camera DriverQualcomm Snapdragon
- CVE-2024-45562Use After Free in HLOSQualcomm Snapdragon
- CVE-2025-4341D-Link DIR-880L Request Header ssdpcgi sub_16570 command injectionD-Link DIR-880L
- CVE-2025-3020Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scriptingWiesemann & Theis ERP-Gateway 12x Digital Input, 6x Dig… +13
- CVE-2025-4340D-Link DIR-890L/DIR-806A1 soap.cgi sub_175C8 command injectionD-Link DIR-890L · D-Link DIR-806A1
- CVE-2025-4333feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java uploadFile unrestricted uploadfeng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- CVE-2025-4332PHPGurukul Company Visitor Management System visitor-detail.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-4331SourceCodester Online Student Clearance System login.php sql injectionSourceCodester Online Student Clearance System
- CVE-2025-3281User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletionwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2025-46593Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect aHuawei HarmonyOS
- CVE-2025-46592Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availabHuawei HarmonyOS
- CVE-2025-46591Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service cHuawei HarmonyOS
- CVE-2025-46590Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypasHuawei HarmonyOS
- CVE-2025-46589Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and Huawei HarmonyOS
- CVE-2025-46588Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and Huawei HarmonyOS
- CVE-2024-58252Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may aHuawei HarmonyOS
- CVE-2025-46587Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidHuawei HarmonyOS
- CVE-2025-46586Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2025-432974CMS index path traversal74CMS
- CVE-2025-4328fp2952 spring-cloud-base HTTP Header MvcController.java sendBack redirectfp2952 spring-cloud-base
- CVE-2025-4327MRCMS cross-site request forgeryMRCMS
- CVE-2025-4326MRCMS Add Fragment Page add.do cross site scriptingMRCMS
- CVE-2025-4325MRCMS Category Management Page add.do cross site scriptingMRCMS
- CVE-2025-4324MRCMS External Link Management Page edit.do cross site scriptingMRCMS
- CVE-2025-4323MRCMS Edit Article Page cross site scriptingMRCMS
- CVE-2025-4314SourceCodester Advanced Web Store index.php sql injectionSourceCodester Advanced Web Store
- CVE-2025-4313SourceCodester Advanced Web Store admin_addnew_product.php sql injectionSourceCodester Advanced Web Store
- CVE-2025-4337AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletionmitchelllevy AHAthat Plugin
- CVE-2025-4312SourceCodester Advanced Web Store productdetail.php sql injectionSourceCodester Advanced Web Store
- CVE-2025-4311itsourcecode Content Management System update_main_topic_img.php sql injectionitsourcecode Content Management System
- CVE-2025-4310itsourcecode Content Management System add_topic.php unrestricted uploaditsourcecode Content Management System
- CVE-2025-4309PHPGurukul Art Gallery Management System add-art-type.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-4308PHPGurukul Art Gallery Management System add-art-type.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-4307PHPGurukul Art Gallery Management System add-art-medium.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-4306PHPGurukul Nipah Virus Testing Management System edit-phlebotomist.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2025-3609Reales WP STPT <= 2.1.2 - Unauthorized User Registrationpixel_prime Reales WP STPT
- CVE-2025-4305kefaming mayi File.php upload unrestricted uploadkefaming mayi
- CVE-2025-4304PHPGurukul Cyber Cafe Management System adminprofile.php sql injectionPHPGurukul Cyber Cafe Management System
- CVE-2024-39442In sprd ssense service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2025-4303PHPGurukul Human Metapneumovirus Testing Management System add-phlebotomist.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-4301itsourcecode Content Management System search-notice.php sql injectionitsourcecode Content Management System
- CVE-2025-4300itsourcecode Content Management System search_list.php sql injectionitsourcecode Content Management System
- CVE-2023-33770Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php.
- CVE-2025-26262An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and exec
- CVE-2025-44900In Tenda RX3 V1.0br_V16.03.13.11 in the GetParentControlInfo function of the web url /goform/GetParentControlInfo, the manipulation of the p
- CVE-2025-45250MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.
- CVE-2025-45487Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.
- CVE-2025-45488Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex
- CVE-2025-45489Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostna
- CVE-2025-45490Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the passwo
- CVE-2025-45492Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.
- CVE-2025-47256Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module inLibxmp