# CVEs published 2025-05-12

125 CVEs were published on May 12, 2025: 16 critical, 41 high. Days are UTC.

- [CVE-2023-49641](https://cve.now/CVE-2023-49641.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2025-46825](https://cve.now/CVE-2025-46825.md): Kanboard has stored Cross-site Scripting vulnerability in project name (CVSS 1.3, kanboard)
- [CVE-2025-31220](https://cve.now/CVE-2025-31220.md): A privacy issue was addressed by removing sensitive data. (CVSS 5.5, Apple iPadOS · Apple macOS)
- [CVE-2025-24258](https://cve.now/CVE-2025-24258.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-31236](https://cve.now/CVE-2025-31236.md): An information disclosure issue was addressed with improved privacy controls. (CVSS 5.5, Apple macOS)
- [CVE-2025-24223](https://cve.now/CVE-2025-24223.md): The issue was addressed with improved memory handling. (CVSS 8.0, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24274](https://cve.now/CVE-2025-24274.md): An input validation issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2025-31241](https://cve.now/CVE-2025-31241.md): A double free issue was addressed with improved memory management. (CVSS 5.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31257](https://cve.now/CVE-2025-31257.md): This issue was addressed with improved memory handling. (CVSS 4.7, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-31256](https://cve.now/CVE-2025-31256.md): The issue was addressed with improved handling of caches. (CVSS 5.5, Apple macOS)
- [CVE-2025-24111](https://cve.now/CVE-2025-24111.md): A memory corruption issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31217](https://cve.now/CVE-2025-31217.md): The issue was addressed with improved input validation. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-31240](https://cve.now/CVE-2025-31240.md): This issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2025-24222](https://cve.now/CVE-2025-24222.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple macOS)
- [CVE-2025-31237](https://cve.now/CVE-2025-31237.md): This issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2025-31260](https://cve.now/CVE-2025-31260.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-31221](https://cve.now/CVE-2025-31221.md): An integer overflow was addressed with improved input validation. (CVSS 7.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31247](https://cve.now/CVE-2025-31247.md): A logic issue was addressed with improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2025-31210](https://cve.now/CVE-2025-31210.md): The issue was addressed with improved UI. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-31206](https://cve.now/CVE-2025-31206.md): A type confusion issue was addressed with improved state handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-30440](https://cve.now/CVE-2025-30440.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-31251](https://cve.now/CVE-2025-31251.md): The issue was addressed with improved input sanitization. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31226](https://cve.now/CVE-2025-31226.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24225](https://cve.now/CVE-2025-24225.md): An injection issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-31227](https://cve.now/CVE-2025-31227.md): A logic issue was addressed with improved checks. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2025-30436](https://cve.now/CVE-2025-30436.md): This issue was addressed by restricting options offered on a locked device. (CVSS 9.1, Apple iOS and iPadOS)
- [CVE-2025-31196](https://cve.now/CVE-2025-31196.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31250](https://cve.now/CVE-2025-31250.md): An information disclosure issue was addressed with improved privacy controls. (CVSS 5.5, Apple macOS)
- [CVE-2025-31207](https://cve.now/CVE-2025-31207.md): A logic issue was addressed with improved checks. (CVSS 7.7, Apple iOS and iPadOS)
- [CVE-2025-31246](https://cve.now/CVE-2025-31246.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple macOS)
- [CVE-2025-31195](https://cve.now/CVE-2025-31195.md): The issue was addressed by adding additional logic. (CVSS 6.3, Apple macOS)
- [CVE-2025-31253](https://cve.now/CVE-2025-31253.md): This issue was addressed through improved state management. (CVSS 7.1, Apple iOS and iPadOS)
- [CVE-2025-30442](https://cve.now/CVE-2025-30442.md): The issue was addressed with improved input sanitization. (CVSS 7.8, Apple macOS)
- [CVE-2025-31204](https://cve.now/CVE-2025-31204.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24155](https://cve.now/CVE-2025-24155.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2025-31212](https://cve.now/CVE-2025-31212.md): This issue was addressed through improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-31245](https://cve.now/CVE-2025-31245.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-31228](https://cve.now/CVE-2025-31228.md): The issue was addressed with improved authentication. (CVSS 6.8, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-31208](https://cve.now/CVE-2025-31208.md): The issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31249](https://cve.now/CVE-2025-31249.md): A logic issue was addressed with improved checks. (CVSS 7.1, Apple macOS)
- [CVE-2025-31232](https://cve.now/CVE-2025-31232.md): A logic issue was addressed with improved checks. (CVSS 7.1, Apple macOS)
- [CVE-2025-31224](https://cve.now/CVE-2025-31224.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2025-31225](https://cve.now/CVE-2025-31225.md): A privacy issue was addressed by removing sensitive data. (CVSS 7.1, Apple iOS and iPadOS)
- [CVE-2025-31233](https://cve.now/CVE-2025-31233.md): The issue was addressed with improved input sanitization. (CVSS 6.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31209](https://cve.now/CVE-2025-31209.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31244](https://cve.now/CVE-2025-31244.md): A file quarantine bypass was addressed with additional checks. (CVSS 8.8, Apple macOS)
- [CVE-2025-31213](https://cve.now/CVE-2025-31213.md): A logging issue was addressed with improved data redaction. (CVSS 7.6, Apple iPadOS · Apple macOS)
- [CVE-2025-24142](https://cve.now/CVE-2025-24142.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2025-31205](https://cve.now/CVE-2025-31205.md): The issue was addressed with improved checks. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-31259](https://cve.now/CVE-2025-31259.md): A privacy issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2025-30448](https://cve.now/CVE-2025-30448.md): This issue was addressed with additional entitlement checks. (CVSS 9.1, Apple iOS and iPadOS · Apple iPadOS +2)
- [CVE-2025-31218](https://cve.now/CVE-2025-31218.md): This issue was addressed by removing the vulnerable code. (CVSS 6.2, Apple macOS)
- [CVE-2025-31234](https://cve.now/CVE-2025-31234.md): The issue was addressed with improved input sanitization. (CVSS 8.2, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-31222](https://cve.now/CVE-2025-31222.md): A correctness issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-31214](https://cve.now/CVE-2025-31214.md): This issue was addressed through improved state management. (CVSS 8.1, Apple iOS and iPadOS)
- [CVE-2025-31238](https://cve.now/CVE-2025-31238.md): The issue was addressed with improved checks. (CVSS 7.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-31239](https://cve.now/CVE-2025-31239.md): A use-after-free issue was addressed with improved memory management. (CVSS 4.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31242](https://cve.now/CVE-2025-31242.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-30453](https://cve.now/CVE-2025-30453.md): The issue was addressed with additional permissions checks. (CVSS 7.8, Apple macOS)
- [CVE-2025-31215](https://cve.now/CVE-2025-31215.md): The issue was addressed with improved checks. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-24144](https://cve.now/CVE-2025-24144.md): An information disclosure issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31223](https://cve.now/CVE-2025-31223.md): The issue was addressed with improved checks. (CVSS 8.0, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-31235](https://cve.now/CVE-2025-31235.md): A double free issue was addressed with improved memory management. (CVSS 6.5, Apple iPadOS · Apple macOS)
- [CVE-2025-24220](https://cve.now/CVE-2025-24220.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-31219](https://cve.now/CVE-2025-31219.md): The issue was addressed with improved memory handling. (CVSS 7.1, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-31258](https://cve.now/CVE-2025-31258.md): This issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple macOS)
- [CVE-2025-3659](https://cve.now/CVE-2025-3659.md): Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP (CVSS 9.4, Digi International Digi PortServer TS · Digi Internation… +1)
- [CVE-2025-1079](https://cve.now/CVE-2025-1079.md): RCE In Google Web Designer (CVSS 7.8, Google Web Designer)
- [CVE-2024-4982](https://cve.now/CVE-2024-4982.md): Pagure: path traversal in view\_issue\_raw\_file() (CVSS 7.6, pagure)
- [CVE-2024-4981](https://cve.now/CVE-2024-4981.md): Pagure: \_update\_file\_in\_git() follows symbolic links in temporary clones (CVSS 7.6, pagure)
- [CVE-2025-47682](https://cve.now/CVE-2025-47682.md): WordPress SMS Alert Order Notifications – WooCommerce plugin \<= 3.8.1 - SQL Injection Vulnerability (CVSS 9.3, Cozy Vision SMS Alert Order Notifications)
- [CVE-2025-3632](https://cve.now/CVE-2025-3632.md): IBM 4769 Developers Toolkit denial of service (CVSS 7.5, IBM 4769 Developers Toolkit)
- [CVE-2025-46743](https://cve.now/CVE-2025-46743.md): Cross-Site Request Forgery (CVSS 6.3, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46750](https://cve.now/CVE-2025-46750.md): Authentication Bypass (CVSS 4.4, Schweitzer Engineering Laboratories SEL-3350-1 · Schweit… +1)
- [CVE-2025-46749](https://cve.now/CVE-2025-46749.md): Improper Neutralization of Input (CVSS 4.3, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46748](https://cve.now/CVE-2025-46748.md): Unverified Password Change (CVSS 2.7, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46747](https://cve.now/CVE-2025-46747.md): Exposure of Sensitive System Information (CVSS 5.7, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46746](https://cve.now/CVE-2025-46746.md): Error Message Contains Sensitive Information (CVSS 5.8, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46745](https://cve.now/CVE-2025-46745.md): Improper Privilege Management (CVSS 6.5, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46744](https://cve.now/CVE-2025-46744.md): Improper Privilege Management (CVSS 2.7, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46742](https://cve.now/CVE-2025-46742.md): Improper Access Control (CVSS 4.3, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46741](https://cve.now/CVE-2025-46741.md): Improper Privilege Management (CVSS 5.7, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46740](https://cve.now/CVE-2025-46740.md): Improper Handling of Insufficient Permissions (CVSS 7.5, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46739](https://cve.now/CVE-2025-46739.md): Improper Restriction of Excessive Authentication Attempts (CVSS 8.1, Schweitzer Engineering Laboratories SEL Blueframe OS)
- [CVE-2025-46738](https://cve.now/CVE-2025-46738.md): Deserialization of Untrusted Data (CVSS 6.6, Schweitzer Engineering Laboratories SEL-5033 acSELerator RT…)
- [CVE-2025-46737](https://cve.now/CVE-2025-46737.md): Origin Validation Error (CVSS 7.4, Schweitzer Engineering Laboratories SEL-5037 Grid Configura…)
- [CVE-2025-47578](https://cve.now/CVE-2025-47578.md): WordPress BNS Twitter Follow Button plugin \<= 0.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Edward Caissie BNS Twitter Follow Button)
- [CVE-2025-47274](https://cve.now/CVE-2025-47274.md): ToolHive stores secrets in the state store with no encryption (CVSS 2.4, stacklok toolhive)
- [CVE-2025-46718](https://cve.now/CVE-2025-46718.md): sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others (CVSS 3.3, trifectatechfoundation sudo-rs · sudo-rs)
- [CVE-2025-46717](https://cve.now/CVE-2025-46717.md): sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders (CVSS 3.3, trifectatechfoundation sudo-rs · sudo-rs)
- [CVE-2025-40627](https://cve.now/CVE-2025-40627.md): Reflected Cross-Site Scripting (XSS) in AbanteCart (CVSS 5.1, AbanteCart)
- [CVE-2025-40626](https://cve.now/CVE-2025-40626.md): Reflected Cross-Site Scripting (XSS) in AbanteCart (CVSS 5.1, AbanteCart)
- [CVE-2025-47271](https://cve.now/CVE-2025-47271.md): OZI-Project/ozi-publish Code Injection vulnerability (CVSS 6.3, OZI-Project publish)
- [CVE-2025-47270](https://cve.now/CVE-2025-47270.md): nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability (CVSS 7.5, nimiq core-rs-albatross)
- [CVE-2025-22247](https://cve.now/CVE-2025-22247.md): Insecure file handling vulnerability (CVSS 6.1, VMware Tools)
- [CVE-2025-46729](https://cve.now/CVE-2025-46729.md): phpDVDProfiler Cross-site Scripting vulnerability (CVSS 2.1, julmud phpDVDProfiler)
- [CVE-2025-32390](https://cve.now/CVE-2025-32390.md): EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover (CVSS 7.0, espocrm)
- [CVE-2025-1533](https://cve.now/CVE-2025-1533.md): A stack buffer overflow has been identified in the AsIO3.sys driver. (CVSS 8.2, ASUS Armoury Crate)
- [CVE-2025-41393](https://cve.now/CVE-2025-41393.md): Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image (CVSS 6.1, Ricoh Company Multiple laser printers and MFPs which implem…)
- [CVE-2025-3496](https://cve.now/CVE-2025-3496.md): AUMA Riester: Buffer overflow in service telegram (CVSS 7.5, Auma Riester AC1.2 · Auma Riester MEC +3)
- [CVE-2025-4561](https://cve.now/CVE-2025-4561.md): Kinfor KFOX - Arbitrary File Upload (CVSS 8.8, Kinfor KFOX)
- [CVE-2025-4560](https://cve.now/CVE-2025-4560.md): Netvision ISOinsight - Missing Authentication (CVSS 6.5, Netvision ISOinsight)
- [CVE-2025-4559](https://cve.now/CVE-2025-4559.md): Netvision ISOinsight - SQL Injection (CVSS 9.8, Netvision ISOinsight)
- [CVE-2025-3649](https://cve.now/CVE-2025-3649.md): LightPress Lightbox \< 2.3.4 - Contributor+ Stored XSS (CVSS 6.8, LightPress Lightbox)
- [CVE-2025-3597](https://cve.now/CVE-2025-3597.md): Firelight Lightbox \< 2.3.15 - Contributor+ Stored XSS (CVSS 5.9, Firelight Lightbox)
- [CVE-2025-4558](https://cve.now/CVE-2025-4558.md): WormHole Tech GPM - Unverified Password Change (CVSS 9.8, WormHole Tech GPM)
- [CVE-2025-4557](https://cve.now/CVE-2025-4557.md): ZONG YU Parking Management System - Missing Authentication (CVSS 9.1, ZONG YU Parking Management System)
- [CVE-2025-4556](https://cve.now/CVE-2025-4556.md): ZONG YU Okcat Parking Management Platform - Arbitrary File Upload (CVSS 9.8, ZONG YU Okcat Parking Management Platform)
- [CVE-2025-4555](https://cve.now/CVE-2025-4555.md): ZONG YU Okcat Parking Management Platform - Missing Authentication (CVSS 9.8, ZONG YU Okcat Parking Management Platform)
- [CVE-2025-4554](https://cve.now/CVE-2025-4554.md): PHPGurukul Apartment Visitors Management System bwdates-passreports-details.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-4553](https://cve.now/CVE-2025-4553.md): PHPGurukul Apartment Visitors Management System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2023-34732](https://cve.now/CVE-2023-34732.md): An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to e (CVSS 5.4)
- [CVE-2024-55466](https://cve.now/CVE-2024-55466.md): An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 (CVSS 6.5)
- [CVE-2024-56523](https://cve.now/CVE-2024-56523.md): Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in (CVSS 9.1)
- [CVE-2024-56524](https://cve.now/CVE-2024-56524.md): Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special charac (CVSS 9.1)
- [CVE-2025-26841](https://cve.now/CVE-2025-26841.md): Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload. (CVSS 6.1)
- [CVE-2025-26846](https://cve.now/CVE-2025-26846.md): An issue was discovered in Znuny before 7.1.4. (CVSS 9.8)
- [CVE-2025-44022](https://cve.now/CVE-2025-44022.md): An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. (CVSS 9.8)
- [CVE-2025-44175](https://cve.now/CVE-2025-44175.md): Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function. (CVSS 5.4)
- [CVE-2025-44176](https://cve.now/CVE-2025-44176.md): Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function. (CVSS 6.5)
- [CVE-2025-44830](https://cve.now/CVE-2025-44830.md): EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface. (CVSS 9.8)
- [CVE-2025-45779](https://cve.now/CVE-2025-45779.md): Tenda AC10 V1.0re\_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter. (CVSS 9.8)
- [CVE-2025-45835](https://cve.now/CVE-2025-45835.md): A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. (CVSS 7.5)
- [CVE-2025-46610](https://cve.now/CVE-2025-46610.md): ARTEC EMA Mail 6.92 allows CSRF. (CVSS 8.8)
- [CVE-2025-46611](https://cve.now/CVE-2025-46611.md): Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.