CVEs published May 14, 2025
105 CVEs were published on May 14, 2025: 12 critical, 34 high.
- Published
- 105
- Critical
- 12
- High
- 34
- Medium
- 55
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- Combodo iTop
- 7
- Zoom Communications Zoom Workplace Apps
- 6
- Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- 5
- Mozilla Thunderbird
- 3
- Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- 3
- Apache Software Foundation Apache IoTDB · org.apache.iot… +1
- 2
- Jenkins Project Jenkins Cadence vManager Plugin · org.jenki…
- 2
- OpenText Advance Authentication
- 2
- Palo Alto Networks Cortex XDR Broker VM
- 2
- PointCloudLibrary pcl
- 2
Critical 12
- CVE-2025-47889In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, alloJenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- CVE-2025-47884In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values Jenkins Project Jenkins OpenID Connect Provider Plugin · io…
- CVE-2025-4641XML External Entity (XXE) injection vulnerability in WebDriverManagerbonigarcia webdrivermanager · io.github.bonigarcia:webdrive…
- CVE-2025-4638Improper Pointer Arithmetic in pclPointCloudLibrary pcl
- CVE-2025-47781Rallly Insufficient Password Login Token Entropy Leads to Account Takeoverlukevella rallly
- CVE-2025-477775ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)nanbingxyz 5ire
- CVE-2024-10865Reflected Cross-Site Scripting vulnerability in OpenText Advanced AuthenticationOpenText Advance Authentication
- CVE-2025-47292Cap Collectif vulnerable to insecure deserialization leading to remote code executioncap-collectif
- CVE-2024-24780Apache IoTDB: Remote Code Execution with untrusted URI of User-defined functionApache Software Foundation Apache IoTDB · org.apache.iot… +1
- CVE-2025-3623Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Functionuncannyowl Uncanny Automator – Easy Automation, Integration…
- CVE-2025-27891An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,
- CVE-2025-32363mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data.
High 34
- CVE-2025-47783label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.HumanSignal label-studio · label-studio
- CVE-2025-47885Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, Jenkins Project Jenkins Health Advisor by CloudBees Plugin…
- CVE-2025-2900IBM Semeru Runtime denial of serviceIBM Semeru Runtime
- CVE-2025-4640Out-of-bounds Write in pclPointCloudLibrary pcl
- CVE-2025-0131GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDKOPSWAT MetaDefender Endpoint Security SDK
- CVE-2025-4639Improper Restriction of XML External Entity Reference in PeergosPeergos
- CVE-2025-4637Divide By Zero in dlibdavisking dlib
- CVE-2025-0130PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted PacketsPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-30663Zoom Workplace Apps - Time-of-check Time-of-useZoom Communications Zoom Workplace Apps
- CVE-2025-47710Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- CVE-2025-47708Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- CVE-2025-47707Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- CVE-2025-47701Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047Drupal Restrict route by IP · drupal/restrict_route_by_ip
- CVE-2025-3909JavaScript Execution via Spoofed PDF Attachment and file:/// LinkMozilla Thunderbird
- CVE-2025-3875Sender Spoofing via Malformed From Header in ThunderbirdMozilla Thunderbird
- CVE-2025-40595A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.SonicWall SMA1000
- CVE-2025-47782motionEye vulnerable to RCE in add_camera Function Due to unsafe command executionmotioneye-project motioneye · motioneye
- CVE-2025-24022iTop server vulnerable to portal code injectionCombodo iTop
- CVE-2024-10864SQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication.OpenText Advance Authentication
- CVE-2025-3600Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2025-3931Yggdrasil: local privilege escalation in yggdrasilyggdrasil · Red Hat Enterprise Linux +2
- CVE-2025-47445WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download VulnerabilityArraytics Eventin
- CVE-2025-3834SQL InjectionManageEngine ADAudit Plus
- CVE-2025-3833SQL InjectionManageEngine ADSelfService Plus
- CVE-2025-26864Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID AuthenticationApache Software Foundation Apache IoTDB · org.apache.iot… +1
- CVE-2025-26795Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driverApache Software Foundation Apache IoTDB JDBC driver · org.a…
- CVE-2025-4430Unauthorized file manipulation in EZD RPNaukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…
- CVE-2025-2875CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality wheSchneider Electric Modicon Controllers M241 / M251 · Schnei…
- CVE-2024-54780Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due
- CVE-2024-55569An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,
- CVE-2024-58101Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode.
- CVE-2025-26783An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W
- CVE-2025-26785An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330
- CVE-2025-44879WS-WN572HP3 V230525 was discovered to contain a buffer overflow in the component /www/cgi-bin/upload.cgi.
Medium, low and unrated 59
- CVE-2025-46836net-tools Stack-based Buffer Overflow vulnerabilityecki net-tools
- CVE-2025-32421Next.js Race Condition to Cache Poisoningvercel next.js · next
- CVE-2024-45067Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentialIntel(R) Gaudi(R) software installers
- CVE-2025-47888Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configJenkins Project Jenkins DingTalk Plugin · io.jenkins.plugin…
- CVE-2025-47887Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permiJenkins Project Jenkins Cadence vManager Plugin · org.jenki…
- CVE-2025-47886A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackersJenkins Project Jenkins Cadence vManager Plugin · org.jenki…
- CVE-2025-33104IBM WebSphere Application Server crossIBM WebSphere Application Server
- CVE-2025-0136PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devicesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0138Prisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web InterfacePalo Alto Networks Prisma Cloud Compute Edition · Palo Alto…
- CVE-2025-0137PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS
- CVE-2025-0135GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect AppPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-0134Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VMPalo Alto Networks Cortex XDR Broker VM
- CVE-2025-0133PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and PortalPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-0132Cortex XDR Broker VM: Unauthenticated User Can Disable Internal ServicesPalo Alto Networks Cortex XDR Broker VM
- CVE-2025-46786Zoom Workplace Apps - Cross-site ScriptingZoom Communications Zoom Workplace Apps
- CVE-2025-4664Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2025-46785Zoom Workplace Apps for Windows - Buffer Over-readZoom Communications Zoom Workplace Apps
- CVE-2025-30668Zoom Workplace Apps - NULL Pointer DereferenceZoom Communications Zoom Workplace Apps
- CVE-2025-30667Zoom Workplace Apps - NULL Pointer DereferenceZoom Communications Zoom Workplace Apps
- CVE-2025-30666Zoom Workplace Apps for Windows - NULL Pointer DereferenceZoom Communications Zoom Workplace Apps for Windows
- CVE-2025-30665Zoom Workplace Apps for Windows - NULL Pointer DereferenceZoom Communications Zoom Workplace Apps for Windows
- CVE-2025-30664Zoom Workplace Apps - Cross-site ScriptingZoom Communications Zoom Workplace Apps
- CVE-2025-47709Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- CVE-2025-47706Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- CVE-2025-47705IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051Drupal IFrame Remove Filter · drupal/iframeremove
- CVE-2025-47704Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050Drupal Klaro Cookie & Consent Management · drupal/klaro
- CVE-2025-47703COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049Drupal COOKiES Consent Management · drupal/cookies
- CVE-2025-47702oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048Drupal oEmbed Providers · drupal/oembed_providers
- CVE-2025-3932Tracking Links in Attachments Bypassed Remote Content BlockingMozilla Thunderbird
- CVE-2025-47778Sulu vulnerable to XXE in SVG File upload Inspectorsulu · sulu/sulu
- CVE-2025-47775Bullfrog's DNS over TCP bypasses domain filteringbullfrogsec bullfrog
- CVE-2025-24969iTop portal user can see any other contact's pictureCombodo iTop
- CVE-2025-24785iTop dashboard vulnerable to denial of serviceCombodo iTop
- CVE-2025-24026iTop Inefficient Regular Expression Complexity vulnerabilityCombodo iTop
- CVE-2025-24021iTop doesn't have mass assignment of fields in the portal formCombodo iTop
- CVE-2024-56157iTop vulnerable to Self XSS in CSV ImportCombodo iTop
- CVE-2024-52601iTop portal Insecure Direct Object Reference vulnerabilityCombodo iTop
- CVE-2025-47436Apache ORC: Potential Heap Buffer Overflow during C++ LZO DecompressionApache Software Foundation Apache ORC
- CVE-2023-53146media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()Linux
- CVE-2025-3769Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object ReferenceLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2024-8988PeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_downloadPeepSo Core: File Uploads
- CVE-2024-13940Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form WebhookNinja Forms Webhooks
- CVE-2024-52290Stored XSS in Configuration Key Functionalitylf-edge ekuiper · github.com/lf-edge/ekuiper +1
- CVE-2025-4520Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updateuncannyowl Uncanny Automator – Easy Automation, Integration…
- CVE-2024-45516An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before
- CVE-2024-54779Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.wi
- CVE-2024-56427An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2
- CVE-2024-57096An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file.
- CVE-2024-57273Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic
- CVE-2025-25370An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive informati
- CVE-2025-26784An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330
- CVE-2025-29686A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2025-29688A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2025-29689A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2025-29690A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2025-29691A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2025-44024Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before.
- CVE-2025-44184SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the website_image,
- CVE-2025-44186SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/Operation/User.php page.