# CVEs published 2025-05-14

105 CVEs were published on May 14, 2025: 12 critical, 34 high. Days are UTC.

- [CVE-2025-47783](https://cve.now/CVE-2025-47783.md): label-studio vulnerable to Cross-Site Scripting (Reflected) via the label\_config parameter. (CVSS 7.6, HumanSignal label-studio · label-studio)
- [CVE-2025-46836](https://cve.now/CVE-2025-46836.md): net-tools Stack-based Buffer Overflow vulnerability (CVSS 6.6, ecki net-tools)
- [CVE-2025-32421](https://cve.now/CVE-2025-32421.md): Next.js Race Condition to Cache Poisoning (CVSS 3.7, vercel next.js · next)
- [CVE-2024-45067](https://cve.now/CVE-2024-45067.md): Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potential (CVSS 5.4, Intel(R) Gaudi(R) software installers)
- [CVE-2025-47889](https://cve.now/CVE-2025-47889.md): In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allo (CVSS 9.8, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2025-47888](https://cve.now/CVE-2025-47888.md): Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the config (CVSS 5.9, Jenkins Project Jenkins DingTalk Plugin · io.jenkins.plugin…)
- [CVE-2025-47887](https://cve.now/CVE-2025-47887.md): Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a\_740b\_a\_48 and earlier allows attackers with Overall/Read permi (CVSS 4.3, Jenkins Project Jenkins Cadence vManager Plugin · org.jenki…)
- [CVE-2025-47886](https://cve.now/CVE-2025-47886.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a\_740b\_a\_48 and earlier allows attackers (CVSS 4.3, Jenkins Project Jenkins Cadence vManager Plugin · org.jenki…)
- [CVE-2025-47885](https://cve.now/CVE-2025-47885.md): Jenkins Health Advisor by CloudBees Plugin 374.v194b\_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, (CVSS 8.8, Jenkins Project Jenkins Health Advisor by CloudBees Plugin…)
- [CVE-2025-47884](https://cve.now/CVE-2025-47884.md): In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values (CVSS 9.1, Jenkins Project Jenkins OpenID Connect Provider Plugin · io…)
- [CVE-2025-33104](https://cve.now/CVE-2025-33104.md): IBM WebSphere Application Server cross (CVSS 4.4, IBM WebSphere Application Server)
- [CVE-2025-2900](https://cve.now/CVE-2025-2900.md): IBM Semeru Runtime denial of service (CVSS 7.5, IBM Semeru Runtime)
- [CVE-2025-0136](https://cve.now/CVE-2025-0136.md): PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices (CVSS 5.3, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0138](https://cve.now/CVE-2025-0138.md): Prisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web Interface (CVSS 2.0, Palo Alto Networks Prisma Cloud Compute Edition · Palo Alto…)
- [CVE-2025-0137](https://cve.now/CVE-2025-0137.md): PAN-OS: Improper Neutralization of Input in the Management Web Interface (CVSS 4.8, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS)
- [CVE-2025-4641](https://cve.now/CVE-2025-4641.md): XML External Entity (XXE) injection vulnerability in WebDriverManager (CVSS 9.3, bonigarcia webdrivermanager · io.github.bonigarcia:webdrive…)
- [CVE-2025-0135](https://cve.now/CVE-2025-0135.md): GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App (CVSS 5.2, Palo Alto Networks GlobalProtect App · Palo Alto Networks G…)
- [CVE-2025-0134](https://cve.now/CVE-2025-0134.md): Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM (CVSS 6.5, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2025-0133](https://cve.now/CVE-2025-0133.md): PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal (CVSS 1.2, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0132](https://cve.now/CVE-2025-0132.md): Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services (CVSS 6.9, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2025-4640](https://cve.now/CVE-2025-4640.md): Out-of-bounds Write in pcl (CVSS 8.3, PointCloudLibrary pcl)
- [CVE-2025-0131](https://cve.now/CVE-2025-0131.md): GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK (CVSS 7.1, OPSWAT MetaDefender Endpoint Security SDK)
- [CVE-2025-4639](https://cve.now/CVE-2025-4639.md): Improper Restriction of XML External Entity Reference in Peergos (CVSS 8.8, Peergos)
- [CVE-2025-4638](https://cve.now/CVE-2025-4638.md): Improper Pointer Arithmetic in pcl (CVSS 9.2, PointCloudLibrary pcl)
- [CVE-2025-4637](https://cve.now/CVE-2025-4637.md): Divide By Zero in dlib (CVSS 8.7, davisking dlib)
- [CVE-2025-46786](https://cve.now/CVE-2025-46786.md): Zoom Workplace Apps - Cross-site Scripting (CVSS 4.3, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-4664](https://cve.now/CVE-2025-4664.md): Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a (CVSS 4.3, Google Chrome)
- [CVE-2025-46785](https://cve.now/CVE-2025-46785.md): Zoom Workplace Apps for Windows - Buffer Over-read (CVSS 6.5, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-30668](https://cve.now/CVE-2025-30668.md): Zoom Workplace Apps - NULL Pointer Dereference (CVSS 6.5, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-0130](https://cve.now/CVE-2025-0130.md): PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets (CVSS 8.2, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-30667](https://cve.now/CVE-2025-30667.md): Zoom Workplace Apps - NULL Pointer Dereference (CVSS 6.5, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-30666](https://cve.now/CVE-2025-30666.md): Zoom Workplace Apps for Windows - NULL Pointer Dereference (CVSS 6.5, Zoom Communications Zoom Workplace Apps for Windows)
- [CVE-2025-30665](https://cve.now/CVE-2025-30665.md): Zoom Workplace Apps for Windows - NULL Pointer Dereference (CVSS 6.5, Zoom Communications Zoom Workplace Apps for Windows)
- [CVE-2025-30664](https://cve.now/CVE-2025-30664.md): Zoom Workplace Apps - Cross-site Scripting (CVSS 6.6, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-30663](https://cve.now/CVE-2025-30663.md): Zoom Workplace Apps - Time-of-check Time-of-use (CVSS 8.8, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-47710](https://cve.now/CVE-2025-47710.md): Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056 (CVSS 7.4, Enterprise MFA - TFA for Drupal · drupal/miniorange\_2fa)
- [CVE-2025-47709](https://cve.now/CVE-2025-47709.md): Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055 (CVSS 6.5, Enterprise MFA - TFA for Drupal · drupal/miniorange\_2fa)
- [CVE-2025-47708](https://cve.now/CVE-2025-47708.md): Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054 (CVSS 8.8, Enterprise MFA - TFA for Drupal · drupal/miniorange\_2fa)
- [CVE-2025-47707](https://cve.now/CVE-2025-47707.md): Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053 (CVSS 7.5, Enterprise MFA - TFA for Drupal · drupal/miniorange\_2fa)
- [CVE-2025-47706](https://cve.now/CVE-2025-47706.md): Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052 (CVSS 4.8, Enterprise MFA - TFA for Drupal · drupal/miniorange\_2fa)
- [CVE-2025-47705](https://cve.now/CVE-2025-47705.md): IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051 (CVSS 6.1, Drupal IFrame Remove Filter · drupal/iframeremove)
- [CVE-2025-47704](https://cve.now/CVE-2025-47704.md): Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050 (CVSS 6.1, Drupal Klaro Cookie & Consent Management · drupal/klaro)
- [CVE-2025-47703](https://cve.now/CVE-2025-47703.md): COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049 (CVSS 6.1, Drupal COOKiES Consent Management · drupal/cookies)
- [CVE-2025-47702](https://cve.now/CVE-2025-47702.md): oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048 (CVSS 6.1, Drupal oEmbed Providers · drupal/oembed\_providers)
- [CVE-2025-47701](https://cve.now/CVE-2025-47701.md): Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047 (CVSS 8.8, Drupal Restrict route by IP · drupal/restrict\_route\_by\_ip)
- [CVE-2025-3932](https://cve.now/CVE-2025-3932.md): Tracking Links in Attachments Bypassed Remote Content Blocking (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2025-3909](https://cve.now/CVE-2025-3909.md): JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVSS 8.1, Mozilla Thunderbird)
- [CVE-2025-3875](https://cve.now/CVE-2025-3875.md): Sender Spoofing via Malformed From Header in Thunderbird (CVSS 7.5, Mozilla Thunderbird)
- [CVE-2025-40595](https://cve.now/CVE-2025-40595.md): A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. (CVSS 7.2, SonicWall SMA1000)
- [CVE-2025-47782](https://cve.now/CVE-2025-47782.md): motionEye vulnerable to RCE in add\_camera Function Due to unsafe command execution (CVSS 8.9, motioneye-project motioneye · motioneye)
- [CVE-2025-47781](https://cve.now/CVE-2025-47781.md): Rallly Insufficient Password Login Token Entropy Leads to Account Takeover (CVSS 9.8, lukevella rallly)
- [CVE-2025-47778](https://cve.now/CVE-2025-47778.md): Sulu vulnerable to XXE in SVG File upload Inspector (CVSS 6.1, sulu · sulu/sulu)
- [CVE-2025-47777](https://cve.now/CVE-2025-47777.md): 5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE) (CVSS 9.7, nanbingxyz 5ire)
- [CVE-2025-47775](https://cve.now/CVE-2025-47775.md): Bullfrog's DNS over TCP bypasses domain filtering (CVSS 6.2, bullfrogsec bullfrog)
- [CVE-2025-24969](https://cve.now/CVE-2025-24969.md): iTop portal user can see any other contact's picture (CVSS 5.0, Combodo iTop)
- [CVE-2025-24785](https://cve.now/CVE-2025-24785.md): iTop dashboard vulnerable to denial of service (CVSS 4.3, Combodo iTop)
- [CVE-2025-24026](https://cve.now/CVE-2025-24026.md): iTop Inefficient Regular Expression Complexity vulnerability (CVSS 5.3, Combodo iTop)
- [CVE-2025-24022](https://cve.now/CVE-2025-24022.md): iTop server vulnerable to portal code injection (CVSS 8.6, Combodo iTop)
- [CVE-2025-24021](https://cve.now/CVE-2025-24021.md): iTop doesn't have mass assignment of fields in the portal form (CVSS 5.0, Combodo iTop)
- [CVE-2024-56157](https://cve.now/CVE-2024-56157.md): iTop vulnerable to Self XSS in CSV Import (CVSS 6.3, Combodo iTop)
- [CVE-2024-52601](https://cve.now/CVE-2024-52601.md): iTop portal Insecure Direct Object Reference vulnerability (CVSS 6.5, Combodo iTop)
- [CVE-2024-10865](https://cve.now/CVE-2024-10865.md): Reflected Cross-Site Scripting vulnerability in OpenText Advanced Authentication (CVSS 9.4, OpenText Advance Authentication)
- [CVE-2024-10864](https://cve.now/CVE-2024-10864.md): SQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication. (CVSS 7.5, OpenText Advance Authentication)
- [CVE-2025-3600](https://cve.now/CVE-2025-3600.md): Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5, Progress Software Telerik UI for ASP.NET AJAX)
- [CVE-2025-47436](https://cve.now/CVE-2025-47436.md): Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression (CVSS 6.0, Apache Software Foundation Apache ORC)
- [CVE-2023-53146](https://cve.now/CVE-2023-53146.md): media: dw2102: Fix null-ptr-deref in dw2102\_i2c\_transfer() (no CVSS, Linux)
- [CVE-2025-3931](https://cve.now/CVE-2025-3931.md): Yggdrasil: local privilege escalation in yggdrasil (CVSS 7.8, yggdrasil · Red Hat Enterprise Linux +2)
- [CVE-2025-47445](https://cve.now/CVE-2025-47445.md): WordPress Eventin plugin \<= 4.0.26 - Arbitrary File Download Vulnerability (CVSS 7.5, Arraytics Eventin)
- [CVE-2025-3769](https://cve.now/CVE-2025-3769.md): Latepoint \<= 5.1.92 - Unauthenticated Insecure Direct Object Reference (CVSS 5.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2025-3834](https://cve.now/CVE-2025-3834.md): SQL Injection (CVSS 8.1, ManageEngine ADAudit Plus)
- [CVE-2025-3833](https://cve.now/CVE-2025-3833.md): SQL Injection (CVSS 8.1, ManageEngine ADSelfService Plus)
- [CVE-2025-47292](https://cve.now/CVE-2025-47292.md): Cap Collectif vulnerable to insecure deserialization leading to remote code execution (CVSS 9.5, cap-collectif)
- [CVE-2025-26864](https://cve.now/CVE-2025-26864.md): Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication (CVSS 7.5, Apache Software Foundation Apache IoTDB · org.apache.iot… +1)
- [CVE-2025-26795](https://cve.now/CVE-2025-26795.md): Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver (CVSS 7.5, Apache Software Foundation Apache IoTDB JDBC driver · org.a…)
- [CVE-2024-24780](https://cve.now/CVE-2024-24780.md): Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function (CVSS 9.8, Apache Software Foundation Apache IoTDB · org.apache.iot… +1)
- [CVE-2025-4430](https://cve.now/CVE-2025-4430.md): Unauthorized file manipulation in EZD RP (CVSS 8.6, Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…)
- [CVE-2025-2875](https://cve.now/CVE-2025-2875.md): CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality whe (CVSS 8.7, Schneider Electric Modicon Controllers M241 / M251 · Schnei…)
- [CVE-2024-8988](https://cve.now/CVE-2024-8988.md): PeepSo Core: File Uploads \<= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file\_download (CVSS 5.3, PeepSo Core: File Uploads)
- [CVE-2024-13940](https://cve.now/CVE-2024-13940.md): Ninja Forms Webhooks \<= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook (CVSS 5.5, Ninja Forms Webhooks)
- [CVE-2024-52290](https://cve.now/CVE-2024-52290.md): Stored XSS in Configuration Key Functionality (CVSS 6.3, lf-edge ekuiper · github.com/lf-edge/ekuiper +1)
- [CVE-2025-4520](https://cve.now/CVE-2025-4520.md): Uncanny Automator \<= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 5.4, uncannyowl Uncanny Automator – Easy Automation, Integration…)
- [CVE-2025-3623](https://cve.now/CVE-2025-3623.md): Uncanny Automator \<= 6.4.0.1 - Unauthenticated PHP Object Injection in automator\_api\_decode\_message Function (CVSS 9.1, uncannyowl Uncanny Automator – Easy Automation, Integration…)
- [CVE-2024-45516](https://cve.now/CVE-2024-45516.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before (CVSS 6.1)
- [CVE-2024-54779](https://cve.now/CVE-2024-54779.md): Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.wi (CVSS 5.4)
- [CVE-2024-54780](https://cve.now/CVE-2024-54780.md): Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due (CVSS 8.8)
- [CVE-2024-55569](https://cve.now/CVE-2024-55569.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, (CVSS 7.5)
- [CVE-2024-56427](https://cve.now/CVE-2024-56427.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2 (CVSS 6.5)
- [CVE-2024-57096](https://cve.now/CVE-2024-57096.md): An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. (CVSS 5.5)
- [CVE-2024-57273](https://cve.now/CVE-2024-57273.md): Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic (CVSS 5.4)
- [CVE-2024-58101](https://cve.now/CVE-2024-58101.md): Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. (CVSS 8.1)
- [CVE-2025-25370](https://cve.now/CVE-2025-25370.md): An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive informati (CVSS 4.6)
- [CVE-2025-26783](https://cve.now/CVE-2025-26783.md): An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W (CVSS 7.5)
- [CVE-2025-26784](https://cve.now/CVE-2025-26784.md): An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 (CVSS 6.5)
- [CVE-2025-26785](https://cve.now/CVE-2025-26785.md): An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 (CVSS 7.5)
- [CVE-2025-27891](https://cve.now/CVE-2025-27891.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, (CVSS 9.1)
- [CVE-2025-29686](https://cve.now/CVE-2025-29686.md): A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c (CVSS 6.1)
- [CVE-2025-29688](https://cve.now/CVE-2025-29688.md): A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c (CVSS 6.1)
- [CVE-2025-29689](https://cve.now/CVE-2025-29689.md): A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c (CVSS 6.1)
- [CVE-2025-29690](https://cve.now/CVE-2025-29690.md): A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c (CVSS 6.1)
- [CVE-2025-29691](https://cve.now/CVE-2025-29691.md): A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a c (CVSS 6.1)
- [CVE-2025-32363](https://cve.now/CVE-2025-32363.md): mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data. (CVSS 9.8)
- [CVE-2025-44024](https://cve.now/CVE-2025-44024.md): Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. (CVSS 6.1)
- [CVE-2025-44184](https://cve.now/CVE-2025-44184.md): SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the website\_image, (CVSS 4.8)
- [CVE-2025-44186](https://cve.now/CVE-2025-44186.md): SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/Operation/User.php page. (CVSS 5.4)
- [CVE-2025-44879](https://cve.now/CVE-2025-44879.md): WS-WN572HP3 V230525 was discovered to contain a buffer overflow in the component /www/cgi-bin/upload.cgi. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.