CVEs published May 12, 2025
125 CVEs were published on May 12, 2025: 16 critical, 41 high.
- Published
- 125
- Critical
- 16
- High
- 41
- Medium
- 61
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 98
Most affected products
- Apple macOS
- 24
- Apple iOS and iPadOS · Apple iPadOS +4
- 13
- Schweitzer Engineering Laboratories SEL Blueframe OS
- 11
- Apple iOS and iPadOS
- 6
- Apple Safari · Apple iOS and iPadOS +4
- 6
- Apple iOS and iPadOS · Apple iPadOS
- 4
- Apple iPadOS · Apple macOS
- 3
- Apple Safari · Apple iOS and iPadOS +5
- 3
- AbanteCart
- 2
- Apple iOS and iPadOS · Apple macOS +3
- 2
Critical 16
- CVE-2023-49641Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2025-30436This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2025-30448This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple iPadOS +2
- CVE-2025-3659Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAPDigi International Digi PortServer TS · Digi Internation… +1
- CVE-2025-47682WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection VulnerabilityCozy Vision SMS Alert Order Notifications
- CVE-2025-4559Netvision ISOinsight - SQL InjectionNetvision ISOinsight
- CVE-2025-4558WormHole Tech GPM - Unverified Password ChangeWormHole Tech GPM
- CVE-2025-4557ZONG YU Parking Management System - Missing AuthenticationZONG YU Parking Management System
- CVE-2025-4556ZONG YU Okcat Parking Management Platform - Arbitrary File UploadZONG YU Okcat Parking Management Platform
- CVE-2025-4555ZONG YU Okcat Parking Management Platform - Missing AuthenticationZONG YU Okcat Parking Management Platform
- CVE-2024-56523Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in
- CVE-2024-56524Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special charac
- CVE-2025-26846An issue was discovered in Znuny before 7.1.4.
- CVE-2025-44022An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.
- CVE-2025-44830EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface.
- CVE-2025-45779Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter.
High 41
- CVE-2025-24258A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24223The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-24274An input validation issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-31240This issue was addressed with improved checks.Apple macOS
- CVE-2025-31237This issue was addressed with improved checks.Apple macOS
- CVE-2025-31221An integer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31247A logic issue was addressed with improved state management.Apple macOS
- CVE-2025-31207A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2025-31246The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-31253This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2025-30442The issue was addressed with improved input sanitization.Apple macOS
- CVE-2025-31204The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-31208The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31249A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-31232A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-31224A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-31225A privacy issue was addressed by removing sensitive data.Apple iOS and iPadOS
- CVE-2025-31244A file quarantine bypass was addressed with additional checks.Apple macOS
- CVE-2025-31213A logging issue was addressed with improved data redaction.Apple iPadOS · Apple macOS
- CVE-2025-31259A privacy issue was addressed with improved checks.Apple macOS
- CVE-2025-31234The issue was addressed with improved input sanitization.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-31222A correctness issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-31214This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2025-31238The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-30453The issue was addressed with additional permissions checks.Apple macOS
- CVE-2025-31223The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-31219The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-1079RCE In Google Web DesignerGoogle Web Designer
- CVE-2024-4982Pagure: path traversal in view_issue_raw_file()pagure
- CVE-2024-4981Pagure: _update_file_in_git() follows symbolic links in temporary clonespagure
- CVE-2025-3632IBM 4769 Developers Toolkit denial of serviceIBM 4769 Developers Toolkit
- CVE-2025-46740Improper Handling of Insufficient PermissionsSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46739Improper Restriction of Excessive Authentication AttemptsSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46737Origin Validation ErrorSchweitzer Engineering Laboratories SEL-5037 Grid Configura…
- CVE-2025-47270nimiq-network-libp2p Uncontrolled Resource Consumption vulnerabilitynimiq core-rs-albatross
- CVE-2025-32390EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeoverespocrm
- CVE-2025-1533A stack buffer overflow has been identified in the AsIO3.sys driver.ASUS Armoury Crate
- CVE-2025-3496AUMA Riester: Buffer overflow in service telegramAuma Riester AC1.2 · Auma Riester MEC +3
- CVE-2025-4561Kinfor KFOX - Arbitrary File UploadKinfor KFOX
- CVE-2025-45835A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207.
- CVE-2025-46610ARTEC EMA Mail 6.92 allows CSRF.
Medium, low and unrated 68
- CVE-2025-46825Kanboard has stored Cross-site Scripting vulnerability in project namekanboard
- CVE-2025-31220A privacy issue was addressed by removing sensitive data.Apple iPadOS · Apple macOS
- CVE-2025-31236An information disclosure issue was addressed with improved privacy controls.Apple macOS
- CVE-2025-31241A double free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31257This issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-31256The issue was addressed with improved handling of caches.Apple macOS
- CVE-2025-24111A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31217The issue was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-24222The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-31260A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31210The issue was addressed with improved UI.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-31206A type confusion issue was addressed with improved state handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-30440The issue was addressed with improved checks.Apple macOS
- CVE-2025-31251The issue was addressed with improved input sanitization.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31226A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24225An injection issue was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-31227A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2025-31196An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31250An information disclosure issue was addressed with improved privacy controls.Apple macOS
- CVE-2025-31195The issue was addressed by adding additional logic.Apple macOS
- CVE-2025-24155The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-31212This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-31245The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-31228The issue was addressed with improved authentication.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-31233The issue was addressed with improved input sanitization.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31209An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24142A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2025-31205The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-31218This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-31239A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31242A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31215The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-24144An information disclosure issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-31235A double free issue was addressed with improved memory management.Apple iPadOS · Apple macOS
- CVE-2025-24220A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-31258This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-46743Cross-Site Request ForgerySchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46750Authentication BypassSchweitzer Engineering Laboratories SEL-3350-1 · Schweit… +1
- CVE-2025-46749Improper Neutralization of InputSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46748Unverified Password ChangeSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46747Exposure of Sensitive System InformationSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46746Error Message Contains Sensitive InformationSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46745Improper Privilege ManagementSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46744Improper Privilege ManagementSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46742Improper Access ControlSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46741Improper Privilege ManagementSchweitzer Engineering Laboratories SEL Blueframe OS
- CVE-2025-46738Deserialization of Untrusted DataSchweitzer Engineering Laboratories SEL-5033 acSELerator RT…
- CVE-2025-47578WordPress BNS Twitter Follow Button plugin <= 0.3.8 - Cross Site Scripting (XSS) vulnerabilityEdward Caissie BNS Twitter Follow Button
- CVE-2025-47274ToolHive stores secrets in the state store with no encryptionstacklok toolhive
- CVE-2025-46718sudo-rs Allows Low Privilege Users to Enumerate Privileges of Otherstrifectatechfoundation sudo-rs · sudo-rs
- CVE-2025-46717sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folderstrifectatechfoundation sudo-rs · sudo-rs
- CVE-2025-40627Reflected Cross-Site Scripting (XSS) in AbanteCartAbanteCart
- CVE-2025-40626Reflected Cross-Site Scripting (XSS) in AbanteCartAbanteCart
- CVE-2025-47271OZI-Project/ozi-publish Code Injection vulnerabilityOZI-Project publish
- CVE-2025-22247Insecure file handling vulnerabilityVMware Tools
- CVE-2025-46729phpDVDProfiler Cross-site Scripting vulnerabilityjulmud phpDVDProfiler
- CVE-2025-41393Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Ricoh Company Multiple laser printers and MFPs which implem…
- CVE-2025-4560Netvision ISOinsight - Missing AuthenticationNetvision ISOinsight
- CVE-2025-3649LightPress Lightbox < 2.3.4 - Contributor+ Stored XSSLightPress Lightbox
- CVE-2025-3597Firelight Lightbox < 2.3.15 - Contributor+ Stored XSSFirelight Lightbox
- CVE-2025-4554PHPGurukul Apartment Visitors Management System bwdates-passreports-details.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-4553PHPGurukul Apartment Visitors Management System bwdates-reports-details.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2023-34732An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to e
- CVE-2024-55466An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1
- CVE-2025-26841Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.
- CVE-2025-44175Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function.
- CVE-2025-44176Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.
- CVE-2025-46611Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script.