CVEs published May 27, 2025
95 CVEs were published on May 27, 2025: 7 critical, 23 high.
- Published
- 95
- Critical
- 7
- High
- 23
- Medium
- 60
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 10
- Google Chrome
- 8
- FreeFloat FTP Server
- 5
- Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- 5
- PHPGurukul News Portal Project
- 4
- Arista Networks EOS
- 3
- Campcodes Online Hospital Management System
- 3
- Google Android
- 3
- SIGB PMB
- 3
- gimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1
- 2
Critical 7
- CVE-2025-32440NetAlertX Vulnerable to Authentication Bypassjokob-sk NetAlertX
- CVE-2025-48057Icinga 2 certificate renewal might incorrectly renew an invalid certificateicinga2
- CVE-2025-41652Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-41651Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-2407Missing Authentication & Authorization in Web-API allows adversary unrestricted accessMobatime AMX MTAPI · Mobatime AMXGT-100
- CVE-2025-48827vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningvBulletin
- CVE-2025-48828Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vBulletin
High 23
- CVE-2025-5222Icu: stack buffer overflow in the srbroot::addtag functionicu · Red Hat Enterprise Linux +1
- CVE-2025-5280Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2025-5063Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2025-5279Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider pluginAmazon Redshift · redshift-connector
- CVE-2024-13966ZKTeco BioTime default passwordZKTeco BioTime
- CVE-2025-27700There is a possible bypass of carrier restrictions due to an unusual root cause.Google Android
- CVE-2025-48383Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leakingcodingjoe django-select2 · django-select2
- CVE-2025-48798Gimp: multiple use after free in xcf parsergimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1
- CVE-2025-48797Gimp: multiple heap buffer overflows in tga parsergimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1
- CVE-2025-48796Gimp: stack-based buffer overflows in file-icogimp · Red Hat Enterprise Linux
- CVE-2025-5272Memory safety bugs fixed in Firefox 139 and Thunderbird 139Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-5270SNI was sometimes unencryptedMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5269Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-5268Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-5262A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC.Mozilla Thunderbird
- CVE-2025-5117Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registrationthemeglow Property – Real Estate Directory Listing
- CVE-2025-41653Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-41650Weidmueller: Denial-of-Service Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-41649Weidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-5228D-Link DI-8100 jhttpd login.cgi httpd_get_parm stack-based overflowD-Link DI-8100
- CVE-2025-5215D-Link DCS-5020L ptdc.cgi websReadEvent stack-based overflowD-Link DCS-5020L
- CVE-2024-49196An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400.
- CVE-2025-45529An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sendi
Medium, low and unrated 65
- CVE-2024-45094IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scriptingIBM Hardware Management Console
- CVE-2025-2826n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.Arista Networks EOS
- CVE-2025-2796On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normalArista Networks EOS
- CVE-2024-11185On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries.Arista Networks EOS
- CVE-2025-40911Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesRRWO Net::CIDR::Set
- CVE-2025-5278Coreutils: heap buffer under-read in gnu coreutils sort via key specificationcoreutils · Red Hat Enterprise Linux +7
- CVE-2025-5198Stackrox: xss in stackroxstackrox · Red Hat Advanced Cluster Security
- CVE-2025-5067Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2025-5283Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2025-5281Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user informaGoogle Chrome
- CVE-2025-5066Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2025-5065Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofinGoogle Chrome
- CVE-2025-5064Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin Google Chrome
- CVE-2025-5252PHPGurukul News Portal Project edit-subadmin.php sql injectionPHPGurukul News Portal Project
- CVE-2025-5251PHPGurukul News Portal Project edit-subcategory.php sql injectionPHPGurukul News Portal Project
- CVE-2025-5250PHPGurukul News Portal Project edit-category.php sql injectionPHPGurukul News Portal Project
- CVE-2025-23247NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coulNVIDIA CUDA Toolkit
- CVE-2025-5249PHPGurukul News Portal Project add-category.php sql injectionPHPGurukul News Portal Project
- CVE-2025-5248PHPGurukul Company Visitor Management System bwdates-reports-details.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-27701In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after calling slice_map_arraGoogle Android
- CVE-2024-56193There is a possible disclosure of Bluetooth adapter details due to a permissions bypass.Google Android
- CVE-2025-48370auth-js Vulnerable to Insecure Path Routing from Malformed User Inputsupabase auth-js · @supabase/auth-js
- CVE-2025-2236Exposure of Sensitive System Information vulnerability during configuration affecting OpenText Advanced Authentication.OpenText Advanced Authentication
- CVE-2025-5247Gowabby HFish url.go LoadUrl improper authenticationGowabby HFish
- CVE-2025-3704WordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerabilityDBAR Productions Volunteer Sign Up Sheets
- CVE-2025-5246Campcodes Online Hospital Management System query-details.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5245GNU Binutils objdump debug.c debug_type_samep memory corruptionGNU Binutils
- CVE-2025-5244GNU Binutils ld elflink.c elf_gc_sweep memory corruptionGNU Binutils
- CVE-2025-5271Devtools' preview ignored CSP headersMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5267Clickjacking vulnerability could have led to leaking saved payment card detailsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5266Script element events leaked cross-origin resource statusMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5265Potential local code execution in “Copy as cURL” commandMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5264Potential local code execution in “Copy as cURL” commandMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5263Error handling for script execution was incorrectly isolated from web contentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4412TCC Bypass via Dylib Loading in Viscosity.appSparkLabs Viscosity
- CVE-2025-23393Reflected XSS in spacewalk-javaContainer suse/manager/5.0/x86_64/server:5.0.4.7.19.1 · SUS…
- CVE-2024-47090XSS via WYSIWYG editorNagvis
- CVE-2024-38866Livestatus Injection in dynmapsNagvis
- CVE-2025-5232PHPGurukul Student Study Center Management System report.php sql injectionPHPGurukul Student Study Center Management System
- CVE-2025-48382Fess has Insecure Temporary File Permissionscodelibs fess · org.codelibs.fess:fess
- CVE-2025-5231PHPGurukul Company Visitor Management System forgot-password.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-48054Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')radashi-org radashi · radashi
- CVE-2025-5230PHPGurukul Online Nurse Hiring System bwdates-report-details.php sql injectionPHPGurukul Online Nurse Hiring System
- CVE-2025-5229Campcodes Online Hospital Management System view-patient.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5227PHPGurukul Small CRM manage-tickets.php sql injectionPHPGurukul Small CRM
- CVE-2025-5226PHPGurukul Small CRM change-password.php sql injectionPHPGurukul Small CRM
- CVE-2025-5225Campcodes Advanced Online Voting System index.php sql injectionCampcodes Advanced Online Voting System
- CVE-2025-5224Campcodes Online Hospital Management System add-doctor.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5221FreeFloat FTP Server QUOTE Command buffer overflowFreeFloat FTP Server
- CVE-2025-4682Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgetswpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2025-4683MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creationinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2025-5220FreeFloat FTP Server GET Command buffer overflowFreeFloat FTP Server
- CVE-2025-33079IBM Controller information disclosureIBM Controller · IBM Cognos Controller
- CVE-2025-5219FreeFloat FTP Server ASCII Command buffer overflowFreeFloat FTP Server
- CVE-2025-5218FreeFloat FTP Server LITERAL Command buffer overflowFreeFloat FTP Server
- CVE-2025-5217FreeFloat FTP Server RMDIR Command buffer overflowFreeFloat FTP Server
- CVE-2025-5216PHPGurukul Student Record System login.php sql injectionPHPGurukul Student Record System
- CVE-2024-49197An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W93
- CVE-2025-22377An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,
- CVE-2025-26211Gibbon before 29.0.00 allows CSRF.GibbonEdu Gibbon
- CVE-2025-45475maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.
- CVE-2025-46173code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.
- CVE-2025-48742The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution.SIGB PMB
- CVE-2025-48743SIGB PMB before 8.0.1.2 allows SQL injection.SIGB PMB
- CVE-2025-48744In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution.SIGB PMB