CVEs published May 26, 2025
69 CVEs were published on May 26, 2025: 4 critical, 10 high.
- Published
- 69
- Critical
- 4
- High
- 10
- Medium
- 52
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Open Asset Import Library Assimp
- 5
- Open Asset Import Library Assimp · pyassimp
- 5
- Summer Pearl Group Vacation Rental Management Platform
- 5
- Realce Tecnologia Queue Ticket Kiosk
- 4
- screen
- 4
- TCMAN GIM
- 4
- H3C SecCenter SMP-E1114P02
- 3
- Pepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…
- 3
- PHPGurukul Employee Record Management System
- 3
- erdogant pypickle · pypickle
- 2
Critical 4
- CVE-2025-23394daily-backup.sh script in cyrus-imapd allows escalation from cyrus to rootopenSUSE Tumbleweed
- CVE-2025-40664Missing authentication vulnerability in TCMAN GIM v11TCMAN GIM
- CVE-2025-35003Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.Apache Software Foundation Apache NuttX RTOS
- CVE-2025-40671SQL injection vulnerability in AES Multimedia's GestnetAES Multimedia Gestnet
High 10
- CVE-2025-23395Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit setscreen
- CVE-2025-5196Wing FTP Server Lua Admin Console unnecessary privilegesWing FTP Server
- CVE-2025-40650Insecure Direct Object Reference (IDOR) in ClickeduClickedu
- CVE-2025-40667Missing authorization vulnerability in TCMAN GIM v11TCMAN GIM
- CVE-2025-40666Time-based blind SQL injection vulnerability in TCMAN GIM v11TCMAN GIM
- CVE-2025-40665Time-based blind SQL injection vulnerability in TCMAN GIM v11TCMAN GIM
- CVE-2025-5180Wondershare Filmora Installer NFWCHK.exe uncontrolled search pathWondershare Filmora
- CVE-2025-40672Privilege Escalation in Panloader.exeGrupo Espiral MS Panloader.exe
- CVE-2025-41655PEPPERL+FUCHS: Attacker can cause a DoS via URLPepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…
- CVE-2025-41654PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocolPepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…
Medium, low and unrated 55
- CVE-2025-5214Kashipara Responsive Online Learing Platform course_detail_user_new.php sql injectionKashipara Responsive Online Learing Platform
- CVE-2025-5213projectworlds Responsive E-Learning System delete_file.php sql injectionprojectworlds Responsive E-Learning System
- CVE-2025-4783Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widgettimstrifler Exclusive Addons for Elementor
- CVE-2025-5212PHPGurukul Employee Record Management System editempexp.php sql injectionPHPGurukul Employee Record Management System
- CVE-2025-5211PHPGurukul Employee Record Management System myprofile.php sql injectionPHPGurukul Employee Record Management System
- CVE-2025-5210PHPGurukul Employee Record Management System loginerms.php sql injectionPHPGurukul Employee Record Management System
- CVE-2025-5208SourceCodester Online Hospital Management System check_availability.php sql injectionSourceCodester Online Hospital Management System
- CVE-2025-5207SourceCodester Client Database Management System superadmin_update_profile.php sql injectionSourceCodester Client Database Management System
- CVE-2025-5206Pixelimity Installation index.php sql injectionPixelimity
- CVE-2025-52051000 Projects Daily College Class Work Report Book dcwr_entry.php sql injection1000 Projects Daily College Class Work Report Book
- CVE-2025-5204Open Asset Import Library Assimp MDLMaterialLoader.cpp ParseSkinLump_3DGS_MDL7 out-of-boundsOpen Asset Import Library Assimp
- CVE-2025-5203Open Asset Import Library Assimp ParsingUtils.h SkipSpaces out-of-boundsOpen Asset Import Library Assimp
- CVE-2025-5202Open Asset Import Library Assimp HL1MDLLoader.cpp validate_header out-of-boundsOpen Asset Import Library Assimp
- CVE-2025-5201Open Asset Import Library Assimp LWOLoader.cpp CountVertsAndFacesLWO2 out-of-boundsOpen Asset Import Library Assimp
- CVE-2025-5200Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 out-of-boundsOpen Asset Import Library Assimp
- CVE-2025-23392Reflected XSS in SystemsController.java in spacewalk-javaContainer suse/manager/5.0/x86_64/server:5.0.4.7.19.1 · SUS…
- CVE-2025-46802Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screenSUSE Linux Enterprise Micro · SUSE Linux Enterprise Modu… +4
- CVE-2025-46803Screen creates by default world-writable PTYsscreen
- CVE-2025-37992net_sched: Flush gso_skb list too during ->change()Linux
- CVE-2025-39498WordPress Spotlight - Social Media Feeds (Premium) plugin <= 1.7.1 - Sensitive Data Exposure vulnerabilitySpotlight - Social Media Feeds
- CVE-2025-46804Screen 5.0.0 and older versions allow file existence tests when installed setuid-rootscreen
- CVE-2025-46805Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-rootscreen
- CVE-2025-5186thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgerythinkgem JeeSite
- CVE-2025-40663Stored Cross-Site Scripting (XSS) in i2A-Cronos by i2Ai2A Cronos
- CVE-2025-40653User enumeration in M3M Printer Server WebM3M Printer Server Web
- CVE-2025-40652Cross-Site Scripting (XSS) in CoverManagerCoverManager
- CVE-2025-5185Summer Pearl Group Vacation Rental Management Platform cross-site request forgerySummer Pearl Group Vacation Rental Management Platform
- CVE-2025-5184Summer Pearl Group Vacation Rental Management Platform HTTP Response Header information disclosureSummer Pearl Group Vacation Rental Management Platform
- CVE-2025-5183Summer Pearl Group Vacation Rental Management Platform Header redirectSummer Pearl Group Vacation Rental Management Platform
- CVE-2025-5182Summer Pearl Group Vacation Rental Management Platform Listing authorizationSummer Pearl Group Vacation Rental Management Platform
- CVE-2025-5181Summer Pearl Group Vacation Rental Management Platform updateListing cross site scriptingSummer Pearl Group Vacation Rental Management Platform
- CVE-2025-4053Unauthorized creation of master key in Mifare Classic Be-Tech cardsBe-Tech Mifare Classic cards
- CVE-2025-5179Realce Tecnologia Queue Ticket Kiosk Cadastro de Administrador Page index.php cross site scriptingRealce Tecnologia Queue Ticket Kiosk
- CVE-2025-5178Realce Tecnologia Queue Ticket Kiosk Image File ajax.php unrestricted uploadRealce Tecnologia Queue Ticket Kiosk
- CVE-2025-4057Activemq-artemis-operator: amq broker operator starting credentials reuseactivemq-artemis-operator · Red Hat AMQ Broker 7.13.0.OP… +3
- CVE-2025-5177Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php cross site scriptingRealce Tecnologia Queue Ticket Kiosk
- CVE-2025-1985PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerabilityPepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…
- CVE-2025-5176Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php sql injectionRealce Tecnologia Queue Ticket Kiosk
- CVE-2025-5175erdogant pypickle pypickle.py save improper authorizationerdogant pypickle · pypickle
- CVE-2025-5174erdogant pypickle pypickle.py load deserializationerdogant pypickle · pypickle
- CVE-2025-5173HumanSignal label-studio-ml-backend PT File neural_nets.py load deserializationHumanSignal label-studio-ml-backend · label-studio-ml
- CVE-2025-41441Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attackerSYNCK GRAPHICA Mailform Pro CGI
- CVE-2025-5172Econtrata valida sql injectionEcontrata
- CVE-2025-5171llisoft MTA Maita Training System OpenController.java this.fileService.download unrestricted uploadllisoft MTA Maita Training System
- CVE-2025-5170llisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo sql injectionllisoft MTA Maita Training System
- CVE-2025-5169Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_3DGS_MDL345 out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-5168Open Asset Import Library Assimp MDLLoader.cpp ImportUVCoordinate_3DGS_MDL345 out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-5167Open Asset Import Library Assimp LWOLoader.h GetS0 out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-5166Open Asset Import Library Assimp MDC File Parser MDCLoader.cpp InternReadFile out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-5165Open Asset Import Library Assimp MDCLoader.cpp ValidateSurfaceHeader out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-5164PerfreeBlog JWT JwtUtil hard-coded keyPerfreeBlog
- CVE-2025-5163yangshare 技术杨工 warehouseManager 仓库管理系统 access controlyangshare 技术杨工 warehouseManager 仓库管理系统
- CVE-2025-5162H3C SecCenter SMP-E1114P02 importFile unrestricted uploadH3C SecCenter SMP-E1114P02
- CVE-2025-5161H3C SecCenter SMP-E1114P02 download operationDailyOut path traversalH3C SecCenter SMP-E1114P02
- CVE-2025-5160H3C SecCenter SMP-E1114P02 download path traversalH3C SecCenter SMP-E1114P02