# CVEs published 2025-05-13

312 CVEs were published on May 13, 2025: 30 critical, 130 high. 10 are now in CISA KEV. Days are UTC.

- [CVE-2025-4574](https://cve.now/CVE-2025-4574.md): Crossbeam-channel: crossbeam-channel vulnerable to double free on drop (CVSS 6.5, crossbeam-channel · Red Hat Directory Server +6)
- [CVE-2025-26646](https://cve.now/CVE-2025-26646.md): .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability (CVSS 8.0, Microsoft .NET · Microsoft Build Tools for Visual Studio +2)
- [CVE-2024-48869](https://cve.now/CVE-2024-48869.md): Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trus (CVSS 5.6, Intel(R) Xeon(R) 6 processor with E-cores when using Intel(…)
- [CVE-2024-47800](https://cve.now/CVE-2024-47800.md): Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of priv (CVSS 5.4, Intel(R) Graphics Driver software)
- [CVE-2024-47795](https://cve.now/CVE-2024-47795.md): Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to pot (CVSS 5.4, Intel(R) oneAPI DPC++/C++ Compiler software)
- [CVE-2024-47550](https://cve.now/CVE-2024-47550.md): Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escal (CVSS 5.4, Endurance Gaming Mode software installers)
- [CVE-2024-46895](https://cve.now/CVE-2024-46895.md): Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an a (CVSS 5.4, Intel(R) Arc™ & Iris(R) Xe graphics software)
- [CVE-2024-45371](https://cve.now/CVE-2024-45371.md): Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated us (CVSS 5.2, Intel(R) Arc™ & Iris(R) Xe graphics software)
- [CVE-2024-45333](https://cve.now/CVE-2024-45333.md): Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authentic (CVSS 6.9, Intel(R) Data Center GPU Flex Series for Windows driver)
- [CVE-2024-45332](https://cve.now/CVE-2024-45332.md): Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect br (CVSS 5.7, Intel(R) Processors)
- [CVE-2024-43420](https://cve.now/CVE-2024-43420.md): Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Ato (CVSS 5.7, Intel Atom(R) processors)
- [CVE-2024-43101](https://cve.now/CVE-2024-43101.md): Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an (CVSS 5.8, Intel(R) Data Center GPU Flex Series for Windows driver sof…)
- [CVE-2024-39833](https://cve.now/CVE-2024-39833.md): Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalatio (CVSS 5.4, Intel(R) QAT software)
- [CVE-2024-39758](https://cve.now/CVE-2024-39758.md): Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 31.0.101.4032 may allow an authenticated us (CVSS 5.1, Intel(R) Arc™ & Iris(R) Xe graphics software)
- [CVE-2024-36292](https://cve.now/CVE-2024-36292.md): Improper buffer restrictions for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an auth (CVSS 8.2, Intel(R) Data Center GPU Flex Series for Windows driver)
- [CVE-2024-31150](https://cve.now/CVE-2024-31150.md): Out-of-bounds read for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable information disclosure v (CVSS 4.8, Intel(R) Graphics Driver software)
- [CVE-2024-31073](https://cve.now/CVE-2024-31073.md): Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of pr (CVSS 5.4, Intel(R) oneAPI Level Zero software)
- [CVE-2024-29222](https://cve.now/CVE-2024-29222.md): Out-of-bounds write for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable denial of service via l (CVSS 5.8, Intel(R) Graphics Driver software)
- [CVE-2024-28956](https://cve.now/CVE-2024-28956.md): Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow (CVSS 5.7, Intel(R) Processors)
- [CVE-2024-28954](https://cve.now/CVE-2024-28954.md): Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation (CVSS 5.4, Intel(R) Graphics Driver installers)
- [CVE-2024-28036](https://cve.now/CVE-2024-28036.md): Improper conditions check for some Intel(R) Arc™ GPU may allow an authenticated user to potentially enable denial of service via local acces (CVSS 5.7, Intel(R) Arc™ GPU)
- [CVE-2025-24495](https://cve.now/CVE-2025-24495.md): Incorrect initialization of resource in the branch prediction unit for some Intel(R) Core™ Ultra Processors may allow an authenticated user (CVSS 6.8, Intel(R) Core™ Ultra Processors)
- [CVE-2025-24308](https://cve.now/CVE-2025-24308.md): Improper input validation in the UEFI firmware error handler for the Intel(R) Server D50DNP and M50FCP may allow a privileged user to potent (CVSS 8.7, Intel(R) Server D50DNP and M50FCP)
- [CVE-2025-23233](https://cve.now/CVE-2025-23233.md): Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated us (CVSS 5.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-22895](https://cve.now/CVE-2025-22895.md): Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a (CVSS 6.0, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-22892](https://cve.now/CVE-2025-22892.md): Uncontrolled resource consumption for some OpenVINO™ model server software maintained by Intel(R) before version 2024.4 may allow an unauthe (CVSS 7.1, OpenVINO™ model server software maintained by Intel)
- [CVE-2025-22848](https://cve.now/CVE-2025-22848.md): Improper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potential (CVSS 5.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-22844](https://cve.now/CVE-2025-22844.md): Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potential (CVSS 5.3, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-22843](https://cve.now/CVE-2025-22843.md): Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated us (CVSS 8.8, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-22448](https://cve.now/CVE-2025-22448.md): Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an authenticated user to (CVSS 6.9, Intel(R) Simics(R) Package Manager software)
- [CVE-2025-22446](https://cve.now/CVE-2025-22446.md): Inadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to pote (CVSS 5.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-21100](https://cve.now/CVE-2025-21100.md): Improper initialization in the UEFI firmware for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to potentially ena (CVSS 5.6, Intel(R) Server D50DNP and M50FCP boards)
- [CVE-2025-21099](https://cve.now/CVE-2025-21099.md): Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege v (CVSS 5.4, Intel(R) Graphics software)
- [CVE-2025-21094](https://cve.now/CVE-2025-21094.md): Improper input validation in the UEFI firmware DXE module for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to po (CVSS 8.7, Intel(R) Server D50DNP and M50FCP boards)
- [CVE-2025-21081](https://cve.now/CVE-2025-21081.md): Protection mechanism failure for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potent (CVSS 2.0, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20629](https://cve.now/CVE-2025-20629.md): Insecure inherited permissions in the NVM Update Utility for some Intel(R) Ethernet Network Adapter E810 Series before version 4.60 may allo (CVSS 5.4, Intel(R) Ethernet Network Adapter E810 Series)
- [CVE-2025-20624](https://cve.now/CVE-2025-20624.md): Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a (CVSS 6.9, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20623](https://cve.now/CVE-2025-20623.md): Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) (CVSS 5.7, Intel(R) Core™ processors)
- [CVE-2025-20618](https://cve.now/CVE-2025-20618.md): Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20616](https://cve.now/CVE-2025-20616.md): Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to p (CVSS 2.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20612](https://cve.now/CVE-2025-20612.md): Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated us (CVSS 5.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20611](https://cve.now/CVE-2025-20611.md): Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a (CVSS 5.7, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20108](https://cve.now/CVE-2025-20108.md): Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authent (CVSS 5.4, Intel(R) Network Adapter Driver installers for Windows)
- [CVE-2025-20104](https://cve.now/CVE-2025-20104.md): Race condition in some Administrative Tools for some Intel(R) Network Adapters package before version 29.4 may allow an authenticated user t (CVSS 5.4, Administrative Tools for some Intel(R) Network Adapters pac…)
- [CVE-2025-20103](https://cve.now/CVE-2025-20103.md): Insufficient resource pool in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enab (CVSS 5.7, Intel(R) Processors)
- [CVE-2025-20101](https://cve.now/CVE-2025-20101.md): Out-of-bounds read for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable information disclosure or denial (CVSS 6.9, Intel(R) Graphics Drivers)
- [CVE-2025-20100](https://cve.now/CVE-2025-20100.md): Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may allow a privileged us (CVSS 8.7, Intel(R) Xeon(R) 6 processor with E-cores)
- [CVE-2025-20095](https://cve.now/CVE-2025-20095.md): Incorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially (CVSS 5.4, Intel(R) RealSense™ SDK software)
- [CVE-2025-20084](https://cve.now/CVE-2025-20084.md): Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to p (CVSS 5.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20083](https://cve.now/CVE-2025-20083.md): Improper authentication in the firmware for the Intel(R) Slim Bootloader may allow a privileged user to potentially enable escalation of pri (CVSS 7.1, Intel(R) Slim Bootloader)
- [CVE-2025-20082](https://cve.now/CVE-2025-20082.md): Time-of-check time-of-use race condition in the UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards may allow (CVSS 8.7, Intel(R) Server D50DNP and M50FCP boards)
- [CVE-2025-20079](https://cve.now/CVE-2025-20079.md): Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escalation of privilege vi (CVSS 5.4, Intel(R) Advisor software)
- [CVE-2025-20076](https://cve.now/CVE-2025-20076.md): Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potential (CVSS 2.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20071](https://cve.now/CVE-2025-20071.md): NULL pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via loca (CVSS 6.8, Intel(R) Graphics Drivers)
- [CVE-2025-20062](https://cve.now/CVE-2025-20062.md): Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potent (CVSS 7.0, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20057](https://cve.now/CVE-2025-20057.md): Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to p (CVSS 5.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20054](https://cve.now/CVE-2025-20054.md): Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denia (CVSS 6.8, Intel(R) Processors)
- [CVE-2025-20052](https://cve.now/CVE-2025-20052.md): Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denial of service via loca (CVSS 6.9, Intel(R) Graphics software)
- [CVE-2025-20047](https://cve.now/CVE-2025-20047.md): Improper locking in the Intel(R) Integrated Connectivity I/O interface (CNVi) for some Intel(R) Core™ Ultra Processors may allow an unauthen (CVSS 5.3, Intel(R) Core™ Ultra Processors)
- [CVE-2025-20046](https://cve.now/CVE-2025-20046.md): Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potent (CVSS 7.2, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20043](https://cve.now/CVE-2025-20043.md): Uncontrolled search path for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially enab (CVSS 5.4, Intel(R) RealSense™ SDK software)
- [CVE-2025-20041](https://cve.now/CVE-2025-20041.md): Uncontrolled search path for some Intel(R) Graphics software for Intel(R) Arc™ graphics and Intel(R) Iris(R) Xe graphics before version 32.0 (CVSS 5.4, Intel(R) Graphics software for Intel(R) Arc™ graphics and I…)
- [CVE-2025-20039](https://cve.now/CVE-2025-20039.md): Race condition for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potent (CVSS 6.9, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20034](https://cve.now/CVE-2025-20034.md): Improper input validation in the BackupBiosUpdate UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards before v (CVSS 5.6, Intel(R) Server D50DNP and M50FCP boards)
- [CVE-2025-20032](https://cve.now/CVE-2025-20032.md): Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to p (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20031](https://cve.now/CVE-2025-20031.md): Improper input validation for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via loc (CVSS 6.8, Intel(R) Graphics Drivers)
- [CVE-2025-20030](https://cve.now/CVE-2025-20030.md): Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a (CVSS 2.1, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20026](https://cve.now/CVE-2025-20026.md): Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to po (CVSS 7.0, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20022](https://cve.now/CVE-2025-20022.md): Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a privileged user to po (CVSS 5.8, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20018](https://cve.now/CVE-2025-20018.md): Untrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privile (CVSS 6.9, Intel(R) Graphics Drivers)
- [CVE-2025-20015](https://cve.now/CVE-2025-20015.md): Uncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authenticated user to poten (CVSS 5.4, Intel(R) Ethernet Connection software)
- [CVE-2025-20013](https://cve.now/CVE-2025-20013.md): Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a (CVSS 4.8, Edge Orchestrator software for Intel(R) Tiber™ Edge Platform)
- [CVE-2025-20012](https://cve.now/CVE-2025-20012.md): Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclo (CVSS 4.1, Intel(R) Core™ Ultra Processors)
- [CVE-2025-20009](https://cve.now/CVE-2025-20009.md): Improper input validation in the UEFI firmware GenerationSetup module for the Intel(R) Server D50DNP and M50FCP boards may allow a privilege (CVSS 5.6, Intel(R) Server D50DNP and M50FCP boards)
- [CVE-2025-20008](https://cve.now/CVE-2025-20008.md): Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to pot (CVSS 5.4, Intel(R) Simics(R) Package Manager software)
- [CVE-2025-20006](https://cve.now/CVE-2025-20006.md): Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potent (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2025-20004](https://cve.now/CVE-2025-20004.md): Insufficient control flow management in the Alias Checking Trusted Module for some Intel(R) Xeon(R) 6 processor E-Cores firmware may allow a (CVSS 8.5, Intel(R) Xeon(R) 6 processor E-Cores firmware)
- [CVE-2025-20003](https://cve.now/CVE-2025-20003.md): Improper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver software installers may allow an authentica (CVSS 7.3, Intel(R) Graphics Driver software installers)
- [CVE-2025-43565](https://cve.now/CVE-2025-43565.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2025-43559](https://cve.now/CVE-2025-43559.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-43562](https://cve.now/CVE-2025-43562.md): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-43566](https://cve.now/CVE-2025-43566.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 6.8, Adobe ColdFusion)
- [CVE-2025-43564](https://cve.now/CVE-2025-43564.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-43560](https://cve.now/CVE-2025-43560.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-43563](https://cve.now/CVE-2025-43563.md): ColdFusion | Improper Access Control (CWE-284) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-43561](https://cve.now/CVE-2025-43561.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.1, Adobe ColdFusion)
- [CVE-2025-30315](https://cve.now/CVE-2025-30315.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2025-30316](https://cve.now/CVE-2025-30316.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Connect)
- [CVE-2025-30314](https://cve.now/CVE-2025-30314.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2025-43567](https://cve.now/CVE-2025-43567.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2025-43554](https://cve.now/CVE-2025-43554.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-43553](https://cve.now/CVE-2025-43553.md): Substance3D - Modeler | Uncontrolled Search Path Element (CWE-427) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-43569](https://cve.now/CVE-2025-43569.md): Substance3D - Stager | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-43571](https://cve.now/CVE-2025-43571.md): Substance3D - Stager | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-43570](https://cve.now/CVE-2025-43570.md): Substance3D - Stager | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-43551](https://cve.now/CVE-2025-43551.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2025-43568](https://cve.now/CVE-2025-43568.md): Substance3D - Stager | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-43549](https://cve.now/CVE-2025-43549.md): Substance3D - Stager | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2025-43572](https://cve.now/CVE-2025-43572.md): Dimension | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-43548](https://cve.now/CVE-2025-43548.md): Dimension | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-3744](https://cve.now/CVE-2025-3744.md): Nomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override (CVSS 7.6, HashiCorp Nomad Enterprise)
- [CVE-2025-43547](https://cve.now/CVE-2025-43547.md): Bridge | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Bridge)
- [CVE-2025-43546](https://cve.now/CVE-2025-43546.md): Bridge | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Bridge)
- [CVE-2025-43545](https://cve.now/CVE-2025-43545.md): Bridge | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Bridge)
- [CVE-2025-30330](https://cve.now/CVE-2025-30330.md): Illustrator | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-30329](https://cve.now/CVE-2025-30329.md): Animate | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Animate)
- [CVE-2025-43557](https://cve.now/CVE-2025-43557.md): Animate | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Animate)
- [CVE-2025-43556](https://cve.now/CVE-2025-43556.md): Animate | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Animate)
- [CVE-2025-43555](https://cve.now/CVE-2025-43555.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2025-30328](https://cve.now/CVE-2025-30328.md): Animate | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Animate)
- [CVE-2025-4660](https://cve.now/CVE-2025-4660.md): Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access (CVSS 8.7, Forescout SecureConnector)
- [CVE-2025-30325](https://cve.now/CVE-2025-30325.md): Photoshop Desktop | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2025-30326](https://cve.now/CVE-2025-30326.md): Photoshop Desktop | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2025-30324](https://cve.now/CVE-2025-30324.md): Photoshop Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2025-30322](https://cve.now/CVE-2025-30322.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-31359](https://cve.now/CVE-2023-31359.md): Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in (CVSS 7.3, AMD AIM-T Manageability API)
- [CVE-2023-31358](https://cve.now/CVE-2023-31358.md): A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in (CVSS 7.3, AMD AIM-T Manageability API)
- [CVE-2025-27197](https://cve.now/CVE-2025-27197.md): Lightroom Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Desktop)
- [CVE-2025-30320](https://cve.now/CVE-2025-30320.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2025-30318](https://cve.now/CVE-2025-30318.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-30319](https://cve.now/CVE-2025-30319.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2025-0035](https://cve.now/CVE-2025-0035.md): Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbi (CVSS 7.3, AMD Cloud Manageability Service)
- [CVE-2025-47280](https://cve.now/CVE-2025-47280.md): Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow (CVSS 2.3, Umbraco.Forms.Issues · Umbraco.Forms +1)
- [CVE-2024-36321](https://cve.now/CVE-2024-36321.md): Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrar (CVSS 7.3, AMD AIM-T Manageability Service)
- [CVE-2024-6364](https://cve.now/CVE-2024-6364.md): Server Identity Validation Bypass in Absolute Persistence® (CVSS 6.9, Absolute Security Absolute Persistence)
- [CVE-2025-24063](https://cve.now/CVE-2025-24063.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-32707](https://cve.now/CVE-2025-32707.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-32705](https://cve.now/CVE-2025-32705.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-32704](https://cve.now/CVE-2025-32704.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-32702](https://cve.now/CVE-2025-32702.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2025-30397](https://cve.now/CVE-2025-30397.md): Scripting Engine Memory Corruption Vulnerability (CVSS 7.5, KEV, Microsoft Windows)
- [CVE-2025-30388](https://cve.now/CVE-2025-30388.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office for Android · Microsoft Office for Univ… +2)
- [CVE-2025-30385](https://cve.now/CVE-2025-30385.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-29974](https://cve.now/CVE-2025-29974.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2025-29963](https://cve.now/CVE-2025-29963.md): Windows Media Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-29962](https://cve.now/CVE-2025-29962.md): Windows Media Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-29961](https://cve.now/CVE-2025-29961.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29958](https://cve.now/CVE-2025-29958.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29957](https://cve.now/CVE-2025-29957.md): Windows Deployment Services Denial of Service Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2025-29956](https://cve.now/CVE-2025-29956.md): Windows SMB Information Disclosure Vulnerability (CVSS 5.4, Microsoft Windows)
- [CVE-2025-29955](https://cve.now/CVE-2025-29955.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2025-29954](https://cve.now/CVE-2025-29954.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2025-29842](https://cve.now/CVE-2025-29842.md): UrlMon Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-29841](https://cve.now/CVE-2025-29841.md): Universal Print Management Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-29840](https://cve.now/CVE-2025-29840.md): Windows Media Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-29839](https://cve.now/CVE-2025-29839.md): Windows Multiple UNC Provider Driver Information Disclosure Vulnerability (CVSS 4.0, Microsoft Windows)
- [CVE-2025-29838](https://cve.now/CVE-2025-29838.md): Windows ExecutionContext Driver Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-29837](https://cve.now/CVE-2025-29837.md): Windows Installer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-29836](https://cve.now/CVE-2025-29836.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29835](https://cve.now/CVE-2025-29835.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29833](https://cve.now/CVE-2025-29833.md): Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2025-29832](https://cve.now/CVE-2025-29832.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29831](https://cve.now/CVE-2025-29831.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 R2 Service Pack · Microsoft W…)
- [CVE-2025-29830](https://cve.now/CVE-2025-29830.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29829](https://cve.now/CVE-2025-29829.md): Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-26685](https://cve.now/CVE-2025-26685.md): Microsoft Defender for Identity Spoofing Vulnerability (CVSS 6.5, Microsoft Defender for Identity)
- [CVE-2025-27488](https://cve.now/CVE-2025-27488.md): Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows 10 HLK · Microsoft Windows 11 HLK 22H2 +3)
- [CVE-2025-26677](https://cve.now/CVE-2025-26677.md): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2025-32709](https://cve.now/CVE-2025-32709.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-21264](https://cve.now/CVE-2025-21264.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Visual Studio Code CoPilot Chat Extension · Micro…)
- [CVE-2025-32706](https://cve.now/CVE-2025-32706.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-32703](https://cve.now/CVE-2025-32703.md): Visual Studio Information Disclosure Vulnerability (CVSS 5.5, Microsoft Visual Studio)
- [CVE-2025-32701](https://cve.now/CVE-2025-32701.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-30400](https://cve.now/CVE-2025-30400.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-30394](https://cve.now/CVE-2025-30394.md): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows Server)
- [CVE-2025-29826](https://cve.now/CVE-2025-29826.md): Microsoft Dataverse Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Dataverse)
- [CVE-2025-30393](https://cve.now/CVE-2025-30393.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-27468](https://cve.now/CVE-2025-27468.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-30387](https://cve.now/CVE-2025-30387.md): Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Azure AI Document Intelligence Studio)
- [CVE-2025-30386](https://cve.now/CVE-2025-30386.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-30384](https://cve.now/CVE-2025-30384.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-30383](https://cve.now/CVE-2025-30383.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-30382](https://cve.now/CVE-2025-30382.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-30381](https://cve.now/CVE-2025-30381.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-30379](https://cve.now/CVE-2025-30379.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-30378](https://cve.now/CVE-2025-30378.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.0, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-30377](https://cve.now/CVE-2025-30377.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-30376](https://cve.now/CVE-2025-30376.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-30375](https://cve.now/CVE-2025-30375.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-29979](https://cve.now/CVE-2025-29979.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-29978](https://cve.now/CVE-2025-29978.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-29977](https://cve.now/CVE-2025-29977.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-29976](https://cve.now/CVE-2025-29976.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-29975](https://cve.now/CVE-2025-29975.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft PC Manager)
- [CVE-2025-29973](https://cve.now/CVE-2025-29973.md): Microsoft Azure File Sync Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure File Sync)
- [CVE-2025-29971](https://cve.now/CVE-2025-29971.md): Web Threat Defense (WTD.sys) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-29970](https://cve.now/CVE-2025-29970.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-29969](https://cve.now/CVE-2025-29969.md): MS-EVEN RPC Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-29968](https://cve.now/CVE-2025-29968.md): Active Directory Certificate Services (AD CS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-29967](https://cve.now/CVE-2025-29967.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2025-29966](https://cve.now/CVE-2025-29966.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2025-29964](https://cve.now/CVE-2025-29964.md): Windows Media Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-29960](https://cve.now/CVE-2025-29960.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-29959](https://cve.now/CVE-2025-29959.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-26684](https://cve.now/CVE-2025-26684.md): Microsoft Defender Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Defender for Endpoint for Linux)
- [CVE-2024-36339](https://cve.now/CVE-2024-36339.md): A DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resul (CVSS 7.3, AMD Optimizing CPU Libraries)
- [CVE-2024-21960](https://cve.now/CVE-2024-21960.md): Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilege (CVSS 7.3, AMD Optimizing CPU Libraries)
- [CVE-2025-30310](https://cve.now/CVE-2025-30310.md): Dreamweaver Desktop | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (CVSS 7.8, Adobe Dreamweaver Desktop)
- [CVE-2025-4658](https://cve.now/CVE-2025-4658.md): Authentication Bypass in OPKSSH (CVSS 9.3, OPKSSH · github.com/openpubkey/opkssh)
- [CVE-2025-3757](https://cve.now/CVE-2025-3757.md): Authentication Bypass in OpenPubKey (CVSS 9.3, OPKSSH · github.com/openpubkey/openpubkey)
- [CVE-2025-47278](https://cve.now/CVE-2025-47278.md): Flask uses fallback key instead of current signing key (CVSS 1.8, pallets flask · flask)
- [CVE-2025-4428](https://cve.now/CVE-2025-4428.md): Remote Code Execution (CVSS 7.2, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2025-4427](https://cve.now/CVE-2025-4427.md): Authentication Bypass (CVSS 5.3, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2025-47276](https://cve.now/CVE-2025-47276.md): Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2i (CVSS 7.5, ChewKeanHo Actualizer)
- [CVE-2025-46721](https://cve.now/CVE-2025-46721.md): nosurf vulnerable to CSRF due to non-functional same-origin request checks (CVSS 6.0, justinas nosurf · github.com/justinas/nosurf)
- [CVE-2025-31493](https://cve.now/CVE-2025-31493.md): Path traversal of collection names during file system lookup (CVSS 6.3, getkirby kirby · getkirby/cms)
- [CVE-2025-30207](https://cve.now/CVE-2025-30207.md): Kirby vulnerable to path traversal in the router for PHP's built-in server (CVSS 2.3, getkirby kirby · getkirby/cms)
- [CVE-2025-22462](https://cve.now/CVE-2025-22462.md): An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows (CVSS 9.8, Ivanti Neurons for ITSM)
- [CVE-2025-22460](https://cve.now/CVE-2025-22460.md): Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privil (CVSS 7.8, Ivanti CSA)
- [CVE-2025-30159](https://cve.now/CVE-2025-30159.md): Kirby vulnerable to path traversal of snippet names in the \`snippet()\` helper (CVSS 6.3, getkirby kirby · getkirby/kirby)
- [CVE-2024-12533](https://cve.now/CVE-2024-12533.md): Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data Manipulation.This is (CVSS 3.3, Phoenix SecureCore Technology)
- [CVE-2025-32756](https://cve.now/CVE-2025-32756.md): A stack-based buffer overflow vulnerability \[CWE-121\] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all version (CVSS 9.6, KEV, Fortinet FortiNDR · Fortinet FortiCamera +3)
- [CVE-2025-22859](https://cve.now/CVE-2025-22859.md): A Relative Path Traversal vulnerability \[CWE-23\] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may allo (CVSS 5.0, Fortinet FortiClientEMS)
- [CVE-2024-35281](https://cve.now/CVE-2024-35281.md): An improper isolation or compartmentalization vulnerability \[CWE-653\] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7. (CVSS 2.3, Fortinet FortiClientMac · Fortinet FortiVoiceUCDesktop)
- [CVE-2024-36340](https://cve.now/CVE-2024-36340.md): A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting (CVSS 6.6, AMD μProf)
- [CVE-2024-42446](https://cve.now/CVE-2024-42446.md): TOCTOU in SmmWhea (CVSS 7.5, AMI AptioV)
- [CVE-2025-4649](https://cve.now/CVE-2025-4649.md): ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. (CVSS 4.9, Centreon web)
- [CVE-2025-32917](https://cve.now/CVE-2025-32917.md): Privilege escalation in jar\_signature (CVSS 5.2, Checkmk)
- [CVE-2025-4648](https://cve.now/CVE-2025-4648.md): A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. (CVSS 8.4, Centreon web)
- [CVE-2025-40583](https://cve.now/CVE-2025-40583.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V2.1 HF0 with SINEMA Remote Connect Edge Client (CVSS 4.4, Siemens SCALANCE LPE9403)
- [CVE-2025-40582](https://cve.now/CVE-2025-40582.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V2.1 HF0 with SINEMA Remote Connect Edge Client (CVSS 7.8, Siemens SCALANCE LPE9403)
- [CVE-2025-40581](https://cve.now/CVE-2025-40581.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V2.1 HF0 with SINEMA Remote Connect Edge Client (CVSS 7.1, Siemens SCALANCE LPE9403)
- [CVE-2025-40580](https://cve.now/CVE-2025-40580.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 6.7, Siemens SCALANCE LPE9403)
- [CVE-2025-40579](https://cve.now/CVE-2025-40579.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 6.7, Siemens SCALANCE LPE9403)
- [CVE-2025-40578](https://cve.now/CVE-2025-40578.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). (CVSS 4.3, Siemens SCALANCE LPE9403)
- [CVE-2025-40577](https://cve.now/CVE-2025-40577.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 4.3, Siemens SCALANCE LPE9403)
- [CVE-2025-40576](https://cve.now/CVE-2025-40576.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 4.3, Siemens SCALANCE LPE9403)
- [CVE-2025-40575](https://cve.now/CVE-2025-40575.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 4.3, Siemens SCALANCE LPE9403)
- [CVE-2025-40574](https://cve.now/CVE-2025-40574.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 7.8, Siemens SCALANCE LPE9403)
- [CVE-2025-40573](https://cve.now/CVE-2025-40573.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 4.4, Siemens SCALANCE LPE9403)
- [CVE-2025-40572](https://cve.now/CVE-2025-40572.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0 HF0). (CVSS 5.5, Siemens SCALANCE LPE9403)
- [CVE-2025-40571](https://cve.now/CVE-2025-40571.md): A vulnerability has been identified in Mendix OIDC SSO (Mendix 10.12 compatible) (All versions \< V4.0.1), Mendix OIDC SSO (Mendix 9 compatib (CVSS 2.2, Siemens Mendix OIDC SSO)
- [CVE-2025-40566](https://cve.now/CVE-2025-40566.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions \< V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions \< V5.0 Update (CVSS 8.8, Siemens SIMATIC PCS neo)
- [CVE-2025-40556](https://cve.now/CVE-2025-40556.md): A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All vers (CVSS 6.5, Siemens BACnet ATEC 550-440 · Siemens BACnet ATEC 550-441 +2)
- [CVE-2025-40555](https://cve.now/CVE-2025-40555.md): A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). (CVSS 4.7, Siemens APOGEE PXC+TALON TC Series)
- [CVE-2025-33025](https://cve.now/CVE-2025-33025.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.16.5), RUGGEDCOM ROX MX5000RE (All versions \< V2.16.5), RUGGE (CVSS 9.9, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2025-33024](https://cve.now/CVE-2025-33024.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.16.5), RUGGEDCOM ROX MX5000RE (All versions \< V2.16.5), RUGGE (CVSS 9.9, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2025-32469](https://cve.now/CVE-2025-32469.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.16.5), RUGGEDCOM ROX MX5000RE (All versions \< V2.16.5), RUGGE (CVSS 9.9, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2025-32454](https://cve.now/CVE-2025-32454.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.14), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-31930](https://cve.now/CVE-2025-31930.md): A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions \< V2.135), IEC 1Ph 7.4kW Child socket/ (CVSS 8.8, Siemens IEC 1Ph 7.4kW Child socket · Siemens IEC 1Ph 7.… +19)
- [CVE-2025-31929](https://cve.now/CVE-2025-31929.md): A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Child socket/ shutter ( (CVSS 4.2, Siemens IEC 1Ph 7.4kW Child socket · Siemens IEC 1Ph 7.… +21)
- [CVE-2025-30176](https://cve.now/CVE-2025-30176.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions \< V (CVSS 7.5, Siemens SIMATIC PCS neo · Siemens SINEC NMS +3)
- [CVE-2025-30175](https://cve.now/CVE-2025-30175.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions \< V (CVSS 7.5, Siemens SIMATIC PCS neo · Siemens SINEC NMS +3)
- [CVE-2025-30174](https://cve.now/CVE-2025-30174.md): A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions \< V (CVSS 7.5, Siemens SIMATIC PCS neo · Siemens SINEC NMS +3)
- [CVE-2025-26390](https://cve.now/CVE-2025-26390.md): A vulnerability has been identified in OZW672 (All versions \< V6.0), OZW772 (All versions \< V6.0). (CVSS 9.8, Siemens OZW672 · Siemens OZW772)
- [CVE-2025-26389](https://cve.now/CVE-2025-26389.md): A vulnerability has been identified in OZW672 (All versions \< V8.0), OZW772 (All versions \< V8.0). (CVSS 10.0, Siemens OZW672 · Siemens OZW772)
- [CVE-2025-24510](https://cve.now/CVE-2025-24510.md): A vulnerability has been identified in MS/TP Point Pickup Module (All versions). (CVSS 6.5, Siemens MS/TP Point Pickup Module)
- [CVE-2025-24009](https://cve.now/CVE-2025-24009.md): A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). (CVSS 5.9, Siemens SIRIUS 3RK3 Modular Safety System · Siemens SIRIUS…)
- [CVE-2025-24008](https://cve.now/CVE-2025-24008.md): A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). (CVSS 6.5, Siemens SIRIUS 3RK3 Modular Safety System · Siemens SIRIUS…)
- [CVE-2025-24007](https://cve.now/CVE-2025-24007.md): A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). (CVSS 7.5, Siemens SIRIUS 3RK3 Modular Safety System · Siemens SIRIUS…)
- [CVE-2024-51447](https://cve.now/CVE-2024-51447.md): A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions \< V2404.2). (CVSS 5.3, Siemens Polarion)
- [CVE-2024-51446](https://cve.now/CVE-2024-51446.md): A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions \< V2404.4). (CVSS 6.5, Siemens Polarion)
- [CVE-2024-51445](https://cve.now/CVE-2024-51445.md): A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions \< V2404.4). (CVSS 6.5, Siemens Polarion)
- [CVE-2024-51444](https://cve.now/CVE-2024-51444.md): A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions \< V2404.4). (CVSS 6.5, Siemens Polarion)
- [CVE-2024-23815](https://cve.now/CVE-2024-23815.md): A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks (CVSS 7.5, Siemens Desigo CC)
- [CVE-2025-40628](https://cve.now/CVE-2025-40628.md): SQL Injection in DomainsPRO (CVSS 9.3, DomainsPRO)
- [CVE-2025-4647](https://cve.now/CVE-2025-4647.md): A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG (CVSS 8.4, Centreon web)
- [CVE-2025-4646](https://cve.now/CVE-2025-4646.md): A high privilege user is able to create and use a valid admin API token in centreon-web (CVSS 7.2, Centreon web)
- [CVE-2025-22248](https://cve.now/CVE-2025-22248.md): \[pgpool\] Unauthenticated access to postgres through pgpool (CVSS 9.4, VMware Bitnami)
- [CVE-2025-41645](https://cve.now/CVE-2025-41645.md): SMA: Sunny Portal demo system privilege escalation (CVSS 8.6, SMA www.sunnyportal.com)
- [CVE-2025-3916](https://cve.now/CVE-2025-3916.md): CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially (CVSS 4.6, Schneider Electric EcoStruxure™ Power Build Rapsody software)
- [CVE-2025-27696](https://cve.now/CVE-2025-27696.md): Apache Superset: Incorrect authorization leading to resource ownership takeover (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2025-4474](https://cve.now/CVE-2025-4474.md): Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed\_admin\_setting\_form\_function Function (CVSS 8.8, vinoth06 Frontend Dashboard)
- [CVE-2025-4339](https://cve.now/CVE-2025-4339.md): TheGem \<= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update (CVSS 4.3, CodexThemes TheGem)
- [CVE-2025-4317](https://cve.now/CVE-2025-4317.md): TheGem \<= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, CodexThemes TheGem)
- [CVE-2025-3107](https://cve.now/CVE-2025-3107.md): Newsletters \<= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter (CVSS 6.5, contrid Newsletters)
- [CVE-2025-4473](https://cve.now/CVE-2025-4473.md): Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax\_request Function (CVSS 8.8, vinoth06 Frontend Dashboard)
- [CVE-2025-4632](https://cve.now/CVE-2025-4632.md): Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attack (CVSS 9.8, KEV, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-22246](https://cve.now/CVE-2025-22246.md): CVE-2025-22246 – UAA Private Key Exposure (CVSS 3.0, Cloud Foundry UAA · Cloud Foundry CF deployment)
- [CVE-2025-22249](https://cve.now/CVE-2025-22249.md): VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249) (CVSS 8.2, Vmware Aria Automation · VMware Cloud Foundation +1)
- [CVE-2025-4396](https://cve.now/CVE-2025-4396.md): Relevanssi \<= 4.24.4 (Free) and \<= 2.27.5 (Premium) - Unauthenticated SQL Injection (CVSS 7.5, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2025-35471](https://cve.now/CVE-2025-35471.md): conda-forge openssl-feedstock writable OPENSSLDIR (CVSS 7.3, conda-forge openssl-feedstock · conda-forge miniforge)
- [CVE-2025-43011](https://cve.now/CVE-2025-43011.md): Missing Authorization Check in SAP Landscape Transformation (PCL Basis) (CVSS 7.7, SAP\_SE SAP Landscape Transformation)
- [CVE-2025-43010](https://cve.now/CVE-2025-43010.md): Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL)) (CVSS 8.3, SAP\_SE SAP S/4HANA Cloud Private Edition or on Premise (SCM…)
- [CVE-2025-43009](https://cve.now/CVE-2025-43009.md): Missing Authorization check in SAP Service Parts Management (SPM) (CVSS 6.3, SAP\_SE SAP Service Parts Management)
- [CVE-2025-43008](https://cve.now/CVE-2025-43008.md): Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal (CVSS 5.8, SAP\_SE SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal)
- [CVE-2025-43007](https://cve.now/CVE-2025-43007.md): Missing Authorization check in SAP Service Parts Management (SPM) (CVSS 6.3, SAP\_SE SAP Service Parts Management)
- [CVE-2025-43006](https://cve.now/CVE-2025-43006.md): Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) (CVSS 6.1, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-43005](https://cve.now/CVE-2025-43005.md): Information Disclosure vulnerability in SAP GUI for Windows (CVSS 4.3, SAP\_SE SAP GUI for Windows)
- [CVE-2025-43004](https://cve.now/CVE-2025-43004.md): Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard) (CVSS 5.3, SAP\_SE SAP Digital Manufacturing)
- [CVE-2025-43003](https://cve.now/CVE-2025-43003.md): Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise) (CVSS 6.4, SAP\_SE SAP S/4HANA)
- [CVE-2025-43002](https://cve.now/CVE-2025-43002.md): Missing Authorization check in SAP S4/HANA (OData meta-data property) (CVSS 4.3, SAP\_SE SAP S4/HANA)
- [CVE-2025-43000](https://cve.now/CVE-2025-43000.md): Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW) (CVSS 7.9, SAP\_SE SAP Business Objects Business Intelligence Platform)
- [CVE-2025-42999](https://cve.now/CVE-2025-42999.md): Insecure Deserialization in SAP NetWeaver (Visual Composer development server) (CVSS 9.1, KEV, SAP\_SE SAP NetWeaver)
- [CVE-2025-42997](https://cve.now/CVE-2025-42997.md): Information Disclosure vulnerability in SAP Gateway Client (CVSS 6.6, SAP\_SE SAP Gateway Client)
- [CVE-2025-31329](https://cve.now/CVE-2025-31329.md): Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 6.2, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2025-30018](https://cve.now/CVE-2025-30018.md): Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (CVSS 8.6, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-30012](https://cve.now/CVE-2025-30012.md): Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (CVSS 10.0, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-30011](https://cve.now/CVE-2025-30011.md): Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (CVSS 5.3, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-30010](https://cve.now/CVE-2025-30010.md): Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (CVSS 6.1, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-30009](https://cve.now/CVE-2025-30009.md): Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (CVSS 6.1, SAP\_SE SAP Supplier Relationship Management)
- [CVE-2025-26662](https://cve.now/CVE-2025-26662.md): Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console (CVSS 4.4, SAP\_SE SAP Data Services Management Console)
- [CVE-2024-46506](https://cve.now/CVE-2024-46506.md): NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings l (CVSS 10.0, NetAlertX)
- [CVE-2024-48766](https://cve.now/CVE-2024-48766.md): NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors r (CVSS 8.6, NetAlertX)
- [CVE-2024-56526](https://cve.now/CVE-2024-56526.md): An issue was discovered in OXID eShop before 7. (CVSS 7.5, oxid-esales/oxideshop-ce · oxid-esales/oxideshop-metapac… +1)
- [CVE-2025-28055](https://cve.now/CVE-2025-28055.md): upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit (CVSS 7.5)
- [CVE-2025-28056](https://cve.now/CVE-2025-28056.md): rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component. (CVSS 9.8)
- [CVE-2025-28057](https://cve.now/CVE-2025-28057.md): owl-admin v3.2.2~ to v4.10.2 is vulnerable to SQL Injection in /admin-api/system/admin\_menus/save\_order. (CVSS 7.2)
- [CVE-2025-44039](https://cve.now/CVE-2025-44039.md): CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. (CVSS 5.1)
- [CVE-2025-44831](https://cve.now/CVE-2025-44831.md): EngineerCMS v1.02 through v2.0.5 has a SQL injection vulnerability in the /project/addproject interface. (CVSS 9.8)
- [CVE-2025-45746](https://cve.now/CVE-2025-45746.md): In ZKT ZKBio CVSecurity 6.4.1\_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service co (CVSS 6.5, ZKTeco ZKBio CVSecurity)
- [CVE-2025-45857](https://cve.now/CVE-2025-45857.md): EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function. (CVSS 9.8)
- [CVE-2025-45858](https://cve.now/CVE-2025-45858.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN\_00459fdc function. (CVSS 9.8)
- [CVE-2025-45859](https://cve.now/CVE-2025-45859.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interfac (CVSS 5.4)
- [CVE-2025-45861](https://cve.now/CVE-2025-45861.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface. (CVSS 9.8)
- [CVE-2025-45863](https://cve.now/CVE-2025-45863.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface (CVSS 9.8)
- [CVE-2025-45864](https://cve.now/CVE-2025-45864.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in the formDhcpv6s interfa (CVSS 5.4)
- [CVE-2025-45865](https://cve.now/CVE-2025-45865.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface. (CVSS 9.8)
- [CVE-2025-45866](https://cve.now/CVE-2025-45866.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the formDhcpv6s interface (CVSS 5.4)
- [CVE-2025-45867](https://cve.now/CVE-2025-45867.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static\_dns1 parameter in the formIpv6Setup interfa (CVSS 5.4)
- [CVE-2025-47204](https://cve.now/CVE-2025-47204.md): An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. (CVSS 6.1, bootstrap-multiselect)
- [CVE-2025-47905](https://cve.now/CVE-2025-47905.md): Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, beca (CVSS 5.4, varnish-software Varnish Cache)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.