CVEs published May 20, 2025
172 CVEs were published on May 20, 2025: 28 critical, 51 high.
- Published
- 172
- Critical
- 28
- High
- 51
- Medium
- 30
- Low
- 4
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 70
Most affected products
- Linux
- 95
- JetBrains TeamCity
- 4
- Schweitzer Engineering Laboratories SEL-5056 Software-Defin…
- 4
- Netgear DGND3700
- 3
- projectworlds Online Time Table Generator
- 3
- typo3 · typo3/cms-core
- 3
- VMware Cloud Foundation
- 3
- IBM Security ReaQta EDR
- 2
- JetBrains YouTrack
- 2
- langroid
- 2
Critical 28
- CVE-2025-47277vLLM Allows Remote Code Execution via PyNcclPipe Communication Servicevllm-project vllm · vllm
- CVE-2025-46724Langroid has a Code Injection vulnerability in TableChatAgentlangroid
- CVE-2025-37959bpf: Scrub packet on bpf_redirect_peerLinux
- CVE-2025-37935net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAMLinux
- CVE-2025-37924ksmbd: fix use-after-free in kerberos authenticationLinux
- CVE-2025-37894net: use sock_gen_put() when sk_state is TCP_TIME_WAITLinux
- CVE-2025-48017Improper Limitation of a Pathname to a Restricted DirectorySchweitzer Engineering Laboratories SEL-5056 Software-Defin…
- CVE-2025-4978Netgear DGND3700 Basic Authentication BRS_top.html improper authenticationNetgear DGND3700
- CVE-2025-40635SQL injection at ComerzziaComerzzia Backoffice: Sales Orchestrator
- CVE-2025-40634Stack-based buffer overflow in TP-Link Archer AX50TP-Link Link Archer AX50
- CVE-2025-4322Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account TakeoverStylemixThemes Motors - Car Dealer, Rental & Listing WordPr…
- CVE-2025-44084D-link DI-8100 16.07.26A1 is vulnerable to Command Injection.
- CVE-2025-44880A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary command
- CVE-2025-44881A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary command
- CVE-2025-44882A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary co
- CVE-2025-44883FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function.
- CVE-2025-44884FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function.
- CVE-2025-44885FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_pos
- CVE-2025-44886FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postc
- CVE-2025-44887FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radIpkey parameter in the web_radiusSrv_post function.
- CVE-2025-44888FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the stp_conf_name parameter in the web_stp_globalSetting_post fun
- CVE-2025-44890FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_notifyv3_add_post function.
- CVE-2025-44891FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function.
- CVE-2025-44893FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the web_acl_mgmt_Rules_Apply_post fu
- CVE-2025-44894FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post f
- CVE-2025-44896FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post functi
- CVE-2025-44897FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftp_srvip parameter in the web_tool_upgradeManager_post fu
- CVE-2025-44898FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit functi
High 51
- CVE-2025-4998H3C Magic R200G HTTP POST Request aspForm EditWlanMacList denial of serviceH3C Magic R200G
- CVE-2025-4997H3C R2+ProG HTTP POST Request aspForm SetAPInfoById denial of serviceH3C R2+ProG
- CVE-2025-47290Containerd vulnerable to host filesystem access during image unpackcontainerd · github.com/containerd/containerd/v2
- CVE-2025-22157This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira CoreAtlassian Jira Core Data Center · Atlassian Jira Core Se… +2
- CVE-2025-4364Exposure of Sensitive System Information to an Unauthorized Control SphereAssured Telematics Fleet Management System
- CVE-2025-48391In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in APIJetBrains YouTrack
- CVE-2025-46725Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_storelangroid
- CVE-2025-37988fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()Linux
- CVE-2025-37984crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()Linux
- CVE-2025-37979ASoC: qcom: Fix sc7280 lpass potential buffer overflowLinux
- CVE-2025-37977scsi: ufs: exynos: Disable iocc if dma-coherent property isn't setLinux
- CVE-2025-37973wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentationLinux
- CVE-2025-37964x86/mm: Eliminate window where TLB flushes may be inadvertently skippedLinux
- CVE-2025-37957KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interceptionLinux
- CVE-2025-37956ksmbd: prevent rename with empty stringLinux
- CVE-2025-37954smb: client: Avoid race in open_cached_dir with lease breaksLinux
- CVE-2025-37952ksmbd: Fix UAF in __close_file_table_idsLinux
- CVE-2025-37949xenbus: Use kref to track req lifetimeLinux
- CVE-2025-37947ksmbd: prevent out-of-bounds stream writes by validating *posLinux
- CVE-2025-37944wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_processLinux
- CVE-2025-37943wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifiLinux
- CVE-2025-37938tracing: Verify event formats that have "%*p.."Linux
- CVE-2025-37936perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.Linux
- CVE-2025-37931btrfs: adjust subpage bit start based on sectorsizeLinux
- CVE-2025-37926ksmbd: fix use-after-free in ksmbd_session_rpc_openLinux
- CVE-2025-37923tracing: Fix oob write in trace_seq_to_buffer()Linux
- CVE-2025-37921vxlan: vnifilter: Fix unlocked deletion of default FDB entryLinux
- CVE-2025-37920xsk: Fix race condition in AF_XDP generic RX pathLinux
- CVE-2025-37918Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()Linux
- CVE-2025-37917net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx pollLinux
- CVE-2025-37915net_sched: drr: Fix double list add in class with netem as child qdiscLinux
- CVE-2025-37914net_sched: ets: Fix double list add in class with netem as child qdiscLinux
- CVE-2025-37913net_sched: qfq: Fix double list add in class with netem as child qdiscLinux
- CVE-2025-37911bnxt_en: Fix out-of-bound memcpy() during ethtool -wLinux
- CVE-2025-37908mm, slab: clean up slab->obj_exts alwaysLinux
- CVE-2025-37906ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmdLinux
- CVE-2025-37903drm/amd/display: Fix slab-use-after-free in hdcpLinux
- CVE-2025-37901irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOsLinux
- CVE-2025-37899ksmbd: fix use-after-free in session logoffLinux
- CVE-2025-48018Deserialization of Untrusted DataSchweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- CVE-2025-48014Improper Restriction of Excessive Authentication AttemptsSchweitzer Engineering Laboratories SEL-5056 Software-Defin…
- CVE-2025-41225VMware vCenter Server authenticated command-execution vulnerabilityVMware vCenter Server · VMware Cloud Foundation +2
- CVE-2025-47941TYPO3 Has Broken Authentication in Backend MFAtypo3 · typo3/cms-backend
- CVE-2025-47940TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainertypo3 · typo3/cms-core
- CVE-2025-41231VMware Cloud Foundation Missing Authorisation VulnerabilityVMware Cloud Foundation
- CVE-2025-41230VMware Cloud Foundation Information Disclosure VulnerabilityVMware Cloud Foundation
- CVE-2025-41229VMware Cloud Foundation Directory Traversal VulnerabilityVMware Cloud Foundation
- CVE-2025-30193Denial of service via crafted TCP exchangePowerDNS DNSdist
- CVE-2025-2929Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSSOrder Delivery Date
- CVE-2024-53359An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request.
- CVE-2025-26086An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get reque
Medium, low and unrated 93
- CVE-2025-5010moonlightL hexo-boot Blog Backend index.html cross site scriptingmoonlightL hexo-boot
- CVE-2025-5008projectworlds Online Time Table Generator add_teacher.php sql injectionprojectworlds Online Time Table Generator
- CVE-2025-5007Part-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scriptingPart-DB
- CVE-2025-5006Campcodes Online Shopping Portal category.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-5004projectworlds Online Time Table Generator add_course.php sql injectionprojectworlds Online Time Table Generator
- CVE-2025-5003projectworlds Online Time Table Generator semester_ajax.php sql injectionprojectworlds Online Time Table Generator
- CVE-2025-5002SourceCodester Client Database Management System user_proposal_update_order.php sql injectionSourceCodester Client Database Management System
- CVE-2025-5001GNU PSPP pspp-convert.c calloc integer overflowGNU PSPP
- CVE-2025-5000Linksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi control_panel_sw command injectionLinksys FGW3000-AH · Linksys FGW3000-HK
- CVE-2025-4999Linksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi sub_4153FC command injectionLinksys FGW3000-AH · Linksys FGW3000-HK
- CVE-2025-48056Hubble CLI vulnerable to character injectioncilium hubble · github.com/cilium/hubble
- CVE-2025-4996Intelbras RF 301K Add Static IP cross site scriptingIntelbras RF
- CVE-2025-47854In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root pageJetBrains TeamCity
- CVE-2025-47853In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possibleJetBrains TeamCity
- CVE-2025-47852In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possibleJetBrains TeamCity
- CVE-2025-47851In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleJetBrains TeamCity
- CVE-2025-47850In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloningJetBrains YouTrack
- CVE-2025-37991parisc: Fix double SIGFPE crashLinux
- CVE-2025-37990wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()Linux
- CVE-2025-37989net: phy: leds: fix memory leakLinux
- CVE-2025-37987pds_core: Prevent possible adminq overflow/stuck conditionLinux
- CVE-2025-37986usb: typec: class: Invalidate USB device pointers on partner unregistrationLinux
- CVE-2025-37985USB: wdm: close race between wdm_open and wdm_wwan_port_stopLinux
- CVE-2025-37983qibfs: fix _another_ leakLinux
- CVE-2025-37982wifi: wl1251: fix memory leak in wl1251_tx_workLinux
- CVE-2025-37981scsi: smartpqi: Use is_kdump_kernel() to check for kdumpLinux
- CVE-2025-37980block: fix resource leak in blk_register_queue() error pathLinux
- CVE-2025-37978block: integrity: Do not call set_page_dirty_lock()Linux
- CVE-2025-37975riscv: module: Fix out-of-bounds relocation accessLinux
- CVE-2025-37974s390/pci: Fix missing check for zpci_create_device() error returnLinux
- CVE-2025-37972Input: mtk-pmic-keys - fix possible null pointer dereferenceLinux
- CVE-2025-37971staging: bcm2835-camera: Initialise dev in v4l2_devLinux
- CVE-2025-37970iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifoLinux
- CVE-2025-37969iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifoLinux
- CVE-2025-37968iio: light: opt3001: fix deadlock due to concurrent flag accessLinux
- CVE-2025-37967usb: typec: ucsi: displayport: Fix deadlockLinux
- CVE-2025-37966riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRLLinux
- CVE-2025-37965drm/amd/display: Fix invalid context error in dml helperLinux
- CVE-2025-37963arm64: bpf: Only mitigate cBPF programs loaded by unprivileged usersLinux
- CVE-2025-37962ksmbd: fix memory leak in parse_lease_state()Linux
- CVE-2025-37961ipvs: fix uninit-value for saddr in do_output_route4Linux
- CVE-2025-37960memblock: Accept allocated memory before use in memblock_double_array()Linux
- CVE-2025-37958mm/huge_memory: fix dereferencing invalid pmd migration entryLinux
- CVE-2025-37955virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()Linux
- CVE-2025-37953sch_htb: make htb_deactivate() idempotentLinux
- CVE-2025-37951drm/v3d: Add job to pending list if the reset was skippedLinux
- CVE-2025-37950ocfs2: fix panic in failed foilio allocationLinux
- CVE-2025-37948arm64: bpf: Add BHB mitigation to the epilogue for cBPF programsLinux
- CVE-2025-37946s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFsLinux
- CVE-2025-37945net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHYLinux
- CVE-2025-37941ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe()Linux
- CVE-2025-37940ftrace: Add cond_resched() to ftrace_graph_set_hash()Linux
- CVE-2025-37939libbpf: Fix accessing BTF.ext core_relo headerLinux
- CVE-2025-37937objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()Linux
- CVE-2024-45641IBM Security ReaQta improper certificate validationIBM Security ReaQta EDR
- CVE-2025-37934ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_directionLinux
- CVE-2025-37933octeon_ep: Fix host hang issue during device rebootLinux
- CVE-2025-37932sch_htb: make htb_qlen_notify() idempotentLinux
- CVE-2025-37930drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()Linux
- CVE-2025-37929arm64: errata: Add missing sentinels to Spectre-BHB MIDR arraysLinux
- CVE-2025-37928dm-bufio: don't schedule in atomic contextLinux
- CVE-2025-37927iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihidLinux
- CVE-2025-37922book3s64/radix : Align section vmemmap start address to PAGE_SIZELinux
- CVE-2025-37919ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slotLinux
- CVE-2025-37916pds_core: remove write-after-free of client_idLinux
- CVE-2025-37912ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()Linux
- CVE-2025-37910ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operationsLinux
- CVE-2025-37909net: lan743x: Fix memleak issue when GSO enabledLinux
- CVE-2025-37907accel/ivpu: Fix locking order in ivpu_job_submitLinux
- CVE-2025-37905firmware: arm_scmi: Balance device refcount when destroying devicesLinux
- CVE-2025-37904btrfs: fix the inode leak in btrfs_iget()Linux
- CVE-2025-37900iommu: Fix two issues in iommu_copy_struct_from_user()Linux
- CVE-2025-37898powerpc64/ftrace: fix module loading without patchable function entriesLinux
- CVE-2025-37897wifi: plfxlc: Remove erroneous assert in plfxlc_mac_releaseLinux
- CVE-2025-37896spi: spi-mem: Add fix to avoid divide errorLinux
- CVE-2025-37895bnxt_en: Fix error handling path in bnxt_init_chip()Linux
- CVE-2025-48016Improper Control of Interaction FrequencySchweitzer Engineering Laboratories SEL-5056 Software-Defin…
- CVE-2025-48015Observable Response DiscrepancySchweitzer Engineering Laboratories SEL-5056 Software-Defin…
- CVE-2023-33861IBM Security ReaQta improper certificate validationIBM Security ReaQta EDR
- CVE-2025-41228VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) VulnerabilityVMware vCenter Server · VMware Cloud Foundation +3
- CVE-2025-41227Denial-of-Service VulnerabilityVMware ESXi · VMware Cloud Foundation +4
- CVE-2025-41226Guest Operations Denial-of-Service VulnerabilityVMware ESXi · VMware Cloud Foundation +2
- CVE-2025-47939TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layertypo3 · typo3/cms-core
- CVE-2025-4980Netgear DGND3700 mini_http currentsetting.htm information disclosureNetgear DGND3700
- CVE-2025-47938TYPO3 Vulnerable to Unverified Password Change for Backend Userstypo3 · typo3/cms-core +1
- CVE-2025-47937TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handlingtypo3 · typo3/cms-core
- CVE-2025-47936TYPO3 Vulnerable to Server Side Request Forgery via Webhookstypo3 · typo3/cms-webhooks
- CVE-2025-4977Netgear DGND3700 BRS_top.html information disclosureNetgear DGND3700
- CVE-2025-37892mtd: inftlcore: Add error check for inftl_read_oob()Linux
- CVE-2025-40633Stored Cross-Site Scripting (XSS) in KoiboxKoibox
- CVE-2025-4951Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" fieldRapid7 AppSpider Pro
- CVE-2024-5878Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Libraryaknieriem Simplelightbox · smub Photo Gallery, Sliders, Pro…
- CVE-2025-45862TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in the formDhcpv6s inter