CVEs published May 22, 2025
136 CVEs were published on May 22, 2025: 12 critical, 56 high.
- Published
- 136
- Critical
- 12
- High
- 56
- Medium
- 66
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- ABB ASPECT-Enterprise · ABB NEXUS Series +1
- 30
- Tridium Niagara Framework · Tridium Niagara Enterprise Secu…
- 10
- GitLab
- 8
- FreeFloat FTP Server
- 4
- MedDream PACS Server
- 4
- sandboxie-plus Sandboxie
- 4
- eCharge Hardy Barth cPH2
- 3
- IBM Aspera Faspex
- 3
- Intermesh groupoffice
- 3
- asterisk
- 2
Critical 12
- CVE-2024-13955SQL Injection 2nd OrderABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-6914Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverWSO2 API Manager · WSO2 Governance Registry +6
- CVE-2024-48853Authenticated Escalation to guest to rootABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-3481MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityMedDream PACS Server
- CVE-2025-3482MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityMedDream PACS Server
- CVE-2025-3483MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityMedDream PACS Server
- CVE-2025-3484MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityMedDream PACS Server
- CVE-2024-41195An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Admini
- CVE-2024-41196An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrat
- CVE-2024-41197An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator v
- CVE-2024-41198An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator vi
- CVE-2025-32814An issue was discovered in Infoblox NETMRI before 7.6.1.
High 56
- CVE-2025-47181Microsoft Edge (Chromium-based) Update Elevation of Privilege VulnerabilityMicrosoft Edge (Chromium-based) Updater
- CVE-2024-51552Weak Password StorageABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13957SSRF Server Side Request ForgeryABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13956SSL Verification BypassABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13952Remote Code ExecutionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51553Predictable FilenameABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48848LARGECONTENT - device disk overutilizationABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13947External System or Configuration ControlABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13946Binary Planting / LoadLibrary DLL's not SignedABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13931Authenticated Relative Path TraversalABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13929Authenticated Servlet Command InjectionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13928Authenticated SQL InjectionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-30172Admin Authorized Remote Code ExecutionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-30171Admin Authorized System File DeletionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-2409Admin Authorized System File corruptionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-2410Admin Authorized Port (iptables) manipulation (open/close/disable ports)ABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-9639Authenticated Remote Code ExecutionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-48075Fiber panics when fiber.Ctx.BodyParser parses invalid range indexgofiber fiber · github.com/gofiber/fiber/v2 +1
- CVE-2025-47779Using malformed From header can forge identity with ";" or NULL in name portionasterisk
- CVE-2025-43596MSP360 Backup (for Windows) insecure filesystem permissionsMSP360 Backup
- CVE-2025-46715Sandboxie Arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM)sandboxie-plus Sandboxie
- CVE-2024-48850Authenticated Absolute Path TraversalABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-33137IBM Aspera Faspex data modificationIBM Aspera Faspex
- CVE-2025-33136IBM Aspera Faspex data modificationIBM Aspera Faspex
- CVE-2025-4366Request Smuggling Vulnerability in PingoraPingora · pingora-core
- CVE-2025-5080Tenda FH451 webExcptypemanFilter stack-based overflowTenda FH451
- CVE-2025-5024Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdusRed Hat Enterprise Linux
- CVE-2025-0993Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-3945Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)Tridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-3944Incorrect Permission Assignment for Critical ResourceTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-46714Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM)sandboxie-plus Sandboxie
- CVE-2025-3937Use of Password Hash with Insufficient Computational EffortTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-46713Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_SET_SECURE_PARAM)sandboxie-plus Sandboxie
- CVE-2025-2272Privilege Escalation and Arbitrary code execution in F1E EndpointForcepoint FIE Endpoint
- CVE-2025-41403SQL InjectionManageEngine ADAudit Plus
- CVE-2025-3836SQL InjectionManageEngine ADAudit Plus
- CVE-2024-25010Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation VulnerabilityEricsson RAN Compute Basebands · Ericsson Site Controller
- CVE-2025-4123A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.Grafana · github.com/grafana/grafana
- CVE-2025-2759GStreamer Incorrect Permission Assignment Local Privilege Escalation VulnerabilityGStreamer
- CVE-2025-3486Allegra isZipEntryValide Directory Traversal Remote Code Execution VulnerabilityAllegra
- CVE-2025-3884Cloudera Hue Ace Editor Directory Traversal Information Disclosure VulnerabilityCloudera Hue
- CVE-2025-3883eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution VulnerabilityeCharge Hardy Barth cPH2
- CVE-2025-3882eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution VulnerabilityeCharge Hardy Barth cPH2
- CVE-2025-3881eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution VulnerabilityeCharge Hardy Barth cPH2
- CVE-2025-3887GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2024-40458An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.
- CVE-2024-40459An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function
- CVE-2024-40460An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE
- CVE-2024-40461An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component
- CVE-2024-40462An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component
- CVE-2024-41199An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator
- CVE-2024-52874In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks.
- CVE-2025-32813An issue was discovered in Infoblox NETMRI before 7.6.1.
- CVE-2025-45468Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account.
- CVE-2025-45471Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.
- CVE-2025-45472Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account.
Medium, low and unrated 68
- CVE-2025-4692ABUP IoT Cloud Platform Incorrect Privilege AssignmentABUP IoT Cloud Platform
- CVE-2025-4338Lantronix Device Installer Improper Restriction of XML External Entity ReferenceLantronix Device Installer
- CVE-2025-48371OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2025-4975Tapo privilege escalation on shared devices using notificationsTP-Link Systems TP-Link Tapo app
- CVE-2025-48374zot logs secretsproject-zot zot · zotregistry.dev/zot
- CVE-2025-48373Schule Has Client-Side Role-Based Access Control (RBAC) Bypass Vulnerabilityschule111 Schule
- CVE-2025-48372Schule Has Insecure OTP Length, is Susceptible to Brute-Force Attacksschule111 Schule
- CVE-2024-5962Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output EncodingWSO2 API Manager · WSO2 Identity Server
- CVE-2024-7487Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native AuthenticationWSO2 Identity Server · WSO2 Client Attestation Filter +1
- CVE-2024-7103Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login FlowWSO2 Identity Server
- CVE-2024-13958Stored Cross Site ScriptingABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13954Serialization / Deserialization of configuration dataABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13953Sensitive Information disclosed in log filesABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13951One way hash with predictable saltABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13950Log InjectionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13949Log ForgingABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13948Insecure PermissionsABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-13930Authenticated Unchecked Loop ConditionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-30169Admin Authorized File Upload and Execute PHPABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-30173Admin Authorized File UploadABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-30170Admin Authorized Exposure of file path, file size or file existenceABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-48369GroupOffice vulnerable to Stored XSS in Tasks Comment SectionIntermesh groupoffice
- CVE-2025-48368GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript ExecutionIntermesh groupoffice
- CVE-2025-48366GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsIntermesh groupoffice
- CVE-2025-48066wire-webapp has no database deletion on client logoutwireapp wire-webapp
- CVE-2025-48061wire-webapp Has Insufficient Session Invalidation after User Logoutwireapp wire-webapp
- CVE-2025-47780cli_permissions.conf: deny option does not work for disallowing shell commandsasterisk
- CVE-2025-46716Sandboxie Arbitrary Kernel Read in SbieDrv.sys API (API_SET_SECURE_PARAM)sandboxie-plus Sandboxie
- CVE-2025-33138IBM Aspera Faspex HTML injectionIBM Aspera Faspex
- CVE-2025-23183UBtech – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')UBtech Freepass
- CVE-2025-5081Campcodes Cybercafe Management System adminprofile.php sql injectionCampcodes Cybercafe Management System
- CVE-2025-23182UBtech – CWE-203: Observable DiscrepancyUBtech Freepass
- CVE-2025-2506When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access tEnterpriseDB pglogical · EnterpriseDB BDR/PGD
- CVE-2024-12093Improper Validation of Consistency within Input in GitLabGitLab
- CVE-2025-0605Weak Authentication in GitLabGitLab
- CVE-2025-0679Exposure of Private Personal Information to an Unauthorized Actor in GitLabGitLab
- CVE-2025-5079PHPGurukul/Campcodes Online Shopping Portal updateorder.php sql injectionPHPGurukul Online Shopping Portal · Campcodes Online Shoppi…
- CVE-2025-32915Sensitive data exposed during automatic agent updatesCheckmk
- CVE-2025-1110Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-5078PHPGurukul/Campcodes Online Shopping Portal subcategory.php sql injectionPHPGurukul Online Shopping Portal · Campcodes Online Shoppi…
- CVE-2025-5077Campcodes Online Shopping Portal edit-subcategory.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-4575The x509 application adds trusted use instead of rejected useOpenSSL
- CVE-2025-5076FreeFloat FTP Server SEND Command buffer overflowFreeFloat FTP Server
- CVE-2025-2853Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-3111Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-4979Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-3943Use of GET Request Method With sensitive Query StringsTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-3942Improper Output Neutralization for LogsTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-3941Improper Handling of Windows: DATA Alternate Data StreamTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-3940Improper Use of Validation FrameworkTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-3939Observable Response DiscrepancyTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-3938Missing Cryptographic StepTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-5075FreeFloat FTP Server DEBUG Command buffer overflowFreeFloat FTP Server
- CVE-2025-3936Incorrect Permission Assignment for Critical ResourceTridium Niagara Framework · Tridium Niagara Enterprise Secu…
- CVE-2025-5074FreeFloat FTP Server PROMPT Command buffer overflowFreeFloat FTP Server
- CVE-2025-5073FreeFloat FTP Server MKDIR Command buffer overflowFreeFloat FTP Server
- CVE-2025-3444Local File InclusionManageEngine ServiceDesk Plus MSP · ManageEngine SupportCen…
- CVE-2025-4280TCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.appPoedit
- CVE-2025-4419Hot Random Image <= 1.9.2 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameterhotwptemplates Hot Random Image
- CVE-2025-4405Hot Random Image <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameterhotwptemplates Hot Random Image
- CVE-2024-9544MapSVG - All Kinds of Maps and Store Locator for WordPress <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingMapSVG
- CVE-2025-4133Blog2Social: Social Media Auto Post & Scheduler < 8.4.0 - Contributor+ Stored XSSBlog2Social: Social Media Auto Post & Scheduler
- CVE-2025-5062WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scriptingautomattic WooCommerce
- CVE-2025-3480MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure VulnerabilityMedDream WEB DICOM Viewer
- CVE-2025-3885Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service VulnerabilityHarman Becker MGU21
- CVE-2023-47466TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is tTagLib
- CVE-2024-54188Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access.
- CVE-2025-32815An issue was discovered in Infoblox NETMRI before 7.6.1.