# CVEs published 2025-05-27

95 CVEs were published on May 27, 2025: 7 critical, 23 high. Days are UTC.

- [CVE-2024-45094](https://cve.now/CVE-2024-45094.md): IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scripting (CVSS 5.5, IBM Hardware Management Console)
- [CVE-2025-2826](https://cve.now/CVE-2025-2826.md): n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. (CVSS 2.6, Arista Networks EOS)
- [CVE-2025-2796](https://cve.now/CVE-2025-2796.md): On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal (CVSS 5.3, Arista Networks EOS)
- [CVE-2024-11185](https://cve.now/CVE-2024-11185.md): On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries. (CVSS 6.5, Arista Networks EOS)
- [CVE-2025-32440](https://cve.now/CVE-2025-32440.md): NetAlertX Vulnerable to Authentication Bypass (CVSS 10.0, jokob-sk NetAlertX)
- [CVE-2025-40911](https://cve.now/CVE-2025-40911.md): Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses (CVSS 6.5, RRWO Net::CIDR::Set)
- [CVE-2025-5278](https://cve.now/CVE-2025-5278.md): Coreutils: heap buffer under-read in gnu coreutils sort via key specification (CVSS 4.4, coreutils · Red Hat Enterprise Linux +7)
- [CVE-2025-5222](https://cve.now/CVE-2025-5222.md): Icu: stack buffer overflow in the srbroot::addtag function (CVSS 7.0, icu · Red Hat Enterprise Linux +1)
- [CVE-2025-5198](https://cve.now/CVE-2025-5198.md): Stackrox: xss in stackrox (CVSS 5.0, stackrox · Red Hat Advanced Cluster Security)
- [CVE-2025-5067](https://cve.now/CVE-2025-5067.md): Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a cra (CVSS 5.4, Google Chrome)
- [CVE-2025-5283](https://cve.now/CVE-2025-5283.md): Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 5.4, Google Chrome)
- [CVE-2025-5281](https://cve.now/CVE-2025-5281.md): Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user informa (CVSS 5.4, Google Chrome)
- [CVE-2025-5066](https://cve.now/CVE-2025-5066.md): Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user t (CVSS 6.5, Google Chrome)
- [CVE-2025-5065](https://cve.now/CVE-2025-5065.md): Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofin (CVSS 6.5, Google Chrome)
- [CVE-2025-5064](https://cve.now/CVE-2025-5064.md): Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin (CVSS 5.4, Google Chrome)
- [CVE-2025-5280](https://cve.now/CVE-2025-5280.md): Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2025-5063](https://cve.now/CVE-2025-5063.md): Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2025-5279](https://cve.now/CVE-2025-5279.md): Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin (CVSS 7.0, Amazon Redshift · redshift-connector)
- [CVE-2024-13966](https://cve.now/CVE-2024-13966.md): ZKTeco BioTime default password (CVSS 7.3, ZKTeco BioTime)
- [CVE-2025-5252](https://cve.now/CVE-2025-5252.md): PHPGurukul News Portal Project edit-subadmin.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-5251](https://cve.now/CVE-2025-5251.md): PHPGurukul News Portal Project edit-subcategory.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-5250](https://cve.now/CVE-2025-5250.md): PHPGurukul News Portal Project edit-category.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-23247](https://cve.now/CVE-2025-23247.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coul (CVSS 4.4, NVIDIA CUDA Toolkit)
- [CVE-2025-48057](https://cve.now/CVE-2025-48057.md): Icinga 2 certificate renewal might incorrectly renew an invalid certificate (CVSS 9.3, icinga2)
- [CVE-2025-5249](https://cve.now/CVE-2025-5249.md): PHPGurukul News Portal Project add-category.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-5248](https://cve.now/CVE-2025-5248.md): PHPGurukul Company Visitor Management System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-27701](https://cve.now/CVE-2025-27701.md): In the function process\_crypto\_cmd, the values of ptrs\[i\] can be potentially equal to NULL which is valid value after calling slice\_map\_arra (CVSS 5.5, Google Android)
- [CVE-2025-27700](https://cve.now/CVE-2025-27700.md): There is a possible bypass of carrier restrictions due to an unusual root cause. (CVSS 8.4, Google Android)
- [CVE-2024-56193](https://cve.now/CVE-2024-56193.md): There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. (CVSS 5.1, Google Android)
- [CVE-2025-48370](https://cve.now/CVE-2025-48370.md): auth-js Vulnerable to Insecure Path Routing from Malformed User Input (CVSS 2.7, supabase auth-js · @supabase/auth-js)
- [CVE-2025-48383](https://cve.now/CVE-2025-48383.md): Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking (CVSS 8.2, codingjoe django-select2 · django-select2)
- [CVE-2025-2236](https://cve.now/CVE-2025-2236.md): Exposure of Sensitive System Information vulnerability during configuration affecting OpenText Advanced Authentication. (CVSS 2.1, OpenText Advanced Authentication)
- [CVE-2025-5247](https://cve.now/CVE-2025-5247.md): Gowabby HFish url.go LoadUrl improper authentication (CVSS 6.9, Gowabby HFish)
- [CVE-2025-3704](https://cve.now/CVE-2025-3704.md): WordPress Volunteer Sign Up Sheets plugin \< 5.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, DBAR Productions Volunteer Sign Up Sheets)
- [CVE-2025-5246](https://cve.now/CVE-2025-5246.md): Campcodes Online Hospital Management System query-details.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5245](https://cve.now/CVE-2025-5245.md): GNU Binutils objdump debug.c debug\_type\_samep memory corruption (CVSS 4.8, GNU Binutils)
- [CVE-2025-48798](https://cve.now/CVE-2025-48798.md): Gimp: multiple use after free in xcf parser (CVSS 7.3, gimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1)
- [CVE-2025-48797](https://cve.now/CVE-2025-48797.md): Gimp: multiple heap buffer overflows in tga parser (CVSS 7.3, gimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1)
- [CVE-2025-48796](https://cve.now/CVE-2025-48796.md): Gimp: stack-based buffer overflows in file-ico (CVSS 7.3, gimp · Red Hat Enterprise Linux)
- [CVE-2025-5244](https://cve.now/CVE-2025-5244.md): GNU Binutils ld elflink.c elf\_gc\_sweep memory corruption (CVSS 4.8, GNU Binutils)
- [CVE-2025-5272](https://cve.now/CVE-2025-5272.md): Memory safety bugs fixed in Firefox 139 and Thunderbird 139 (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5271](https://cve.now/CVE-2025-5271.md): Devtools' preview ignored CSP headers (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5270](https://cve.now/CVE-2025-5270.md): SNI was sometimes unencrypted (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5269](https://cve.now/CVE-2025-5269.md): Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5268](https://cve.now/CVE-2025-5268.md): Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5267](https://cve.now/CVE-2025-5267.md): Clickjacking vulnerability could have led to leaking saved payment card details (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5266](https://cve.now/CVE-2025-5266.md): Script element events leaked cross-origin resource status (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5265](https://cve.now/CVE-2025-5265.md): Potential local code execution in “Copy as cURL” command (CVSS 4.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5264](https://cve.now/CVE-2025-5264.md): Potential local code execution in “Copy as cURL” command (CVSS 4.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5263](https://cve.now/CVE-2025-5263.md): Error handling for script execution was incorrectly isolated from web content (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5262](https://cve.now/CVE-2025-5262.md): A double-free could have occurred in \`vpx\_codec\_enc\_init\_multi\` after a failed allocation when initializing the encoder for WebRTC. (CVSS 7.5, Mozilla Thunderbird)
- [CVE-2025-5117](https://cve.now/CVE-2025-5117.md): Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property\_package\_user\_role Metadata in PayPal Registration (CVSS 8.8, themeglow Property – Real Estate Directory Listing)
- [CVE-2025-4412](https://cve.now/CVE-2025-4412.md): TCC Bypass via Dylib Loading in Viscosity.app (CVSS 4.8, SparkLabs Viscosity)
- [CVE-2025-41653](https://cve.now/CVE-2025-41653.md): Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet Switches (CVSS 7.5, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41652](https://cve.now/CVE-2025-41652.md): Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches (CVSS 9.8, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41651](https://cve.now/CVE-2025-41651.md): Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches (CVSS 9.8, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41650](https://cve.now/CVE-2025-41650.md): Weidmueller: Denial-of-Service Vulnerability in Industrial Ethernet Switches (CVSS 7.5, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41649](https://cve.now/CVE-2025-41649.md): Weidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet Switches (CVSS 7.5, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-2407](https://cve.now/CVE-2025-2407.md): Missing Authentication & Authorization in Web-API allows adversary unrestricted access (CVSS 9.3, Mobatime AMX MTAPI · Mobatime AMXGT-100)
- [CVE-2025-23393](https://cve.now/CVE-2025-23393.md): Reflected XSS in spacewalk-java (CVSS 5.2, Container suse/manager/5.0/x86\_64/server:5.0.4.7.19.1 · SUS…)
- [CVE-2024-47090](https://cve.now/CVE-2024-47090.md): XSS via WYSIWYG editor (CVSS 5.1, Nagvis)
- [CVE-2024-38866](https://cve.now/CVE-2024-38866.md): Livestatus Injection in dynmaps (CVSS 5.3, Nagvis)
- [CVE-2025-5232](https://cve.now/CVE-2025-5232.md): PHPGurukul Student Study Center Management System report.php sql injection (CVSS 5.1, PHPGurukul Student Study Center Management System)
- [CVE-2025-48382](https://cve.now/CVE-2025-48382.md): Fess has Insecure Temporary File Permissions (CVSS 1.2, codelibs fess · org.codelibs.fess:fess)
- [CVE-2025-5231](https://cve.now/CVE-2025-5231.md): PHPGurukul Company Visitor Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-48054](https://cve.now/CVE-2025-48054.md): Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CVSS 6.8, radashi-org radashi · radashi)
- [CVE-2025-5230](https://cve.now/CVE-2025-5230.md): PHPGurukul Online Nurse Hiring System bwdates-report-details.php sql injection (CVSS 6.9, PHPGurukul Online Nurse Hiring System)
- [CVE-2025-5229](https://cve.now/CVE-2025-5229.md): Campcodes Online Hospital Management System view-patient.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5228](https://cve.now/CVE-2025-5228.md): D-Link DI-8100 jhttpd login.cgi httpd\_get\_parm stack-based overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2025-5227](https://cve.now/CVE-2025-5227.md): PHPGurukul Small CRM manage-tickets.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-5226](https://cve.now/CVE-2025-5226.md): PHPGurukul Small CRM change-password.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-5225](https://cve.now/CVE-2025-5225.md): Campcodes Advanced Online Voting System index.php sql injection (CVSS 6.9, Campcodes Advanced Online Voting System)
- [CVE-2025-5224](https://cve.now/CVE-2025-5224.md): Campcodes Online Hospital Management System add-doctor.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5221](https://cve.now/CVE-2025-5221.md): FreeFloat FTP Server QUOTE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-4682](https://cve.now/CVE-2025-4682.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2025-4683](https://cve.now/CVE-2025-4683.md): MStore API – Create Native Android & iOS Apps On The Cloud \<= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2025-5220](https://cve.now/CVE-2025-5220.md): FreeFloat FTP Server GET Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-33079](https://cve.now/CVE-2025-33079.md): IBM Controller information disclosure (CVSS 6.5, IBM Controller · IBM Cognos Controller)
- [CVE-2025-5219](https://cve.now/CVE-2025-5219.md): FreeFloat FTP Server ASCII Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5218](https://cve.now/CVE-2025-5218.md): FreeFloat FTP Server LITERAL Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5217](https://cve.now/CVE-2025-5217.md): FreeFloat FTP Server RMDIR Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5216](https://cve.now/CVE-2025-5216.md): PHPGurukul Student Record System login.php sql injection (CVSS 6.9, PHPGurukul Student Record System)
- [CVE-2025-5215](https://cve.now/CVE-2025-5215.md): D-Link DCS-5020L ptdc.cgi websReadEvent stack-based overflow (CVSS 8.7, D-Link DCS-5020L)
- [CVE-2024-49196](https://cve.now/CVE-2024-49196.md): An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. (CVSS 7.5)
- [CVE-2024-49197](https://cve.now/CVE-2024-49197.md): An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W93 (CVSS 6.5)
- [CVE-2025-22377](https://cve.now/CVE-2025-22377.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, (CVSS 6.5)
- [CVE-2025-26211](https://cve.now/CVE-2025-26211.md): Gibbon before 29.0.00 allows CSRF. (CVSS 3.7, GibbonEdu Gibbon)
- [CVE-2025-45475](https://cve.now/CVE-2025-45475.md): maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. (CVSS 5.4)
- [CVE-2025-45529](https://cve.now/CVE-2025-45529.md): An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sendi (CVSS 7.1)
- [CVE-2025-46173](https://cve.now/CVE-2025-46173.md): code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form. (CVSS 6.1)
- [CVE-2025-48742](https://cve.now/CVE-2025-48742.md): The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution. (CVSS 5.4, SIGB PMB)
- [CVE-2025-48743](https://cve.now/CVE-2025-48743.md): SIGB PMB before 8.0.1.2 allows SQL injection. (CVSS 5.3, SIGB PMB)
- [CVE-2025-48744](https://cve.now/CVE-2025-48744.md): In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. (CVSS 6.4, SIGB PMB)
- [CVE-2025-48827](https://cve.now/CVE-2025-48827.md): vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running (CVSS 10.0, vBulletin)
- [CVE-2025-48828](https://cve.now/CVE-2025-48828.md): Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. (CVSS 9.0, vBulletin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.