CVEs published May 29, 2025
78 CVEs were published on May 29, 2025: 12 critical, 20 high.
- Published
- 78
- Critical
- 12
- High
- 20
- Medium
- 40
- Low
- 2
- Unrated
- 4
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- freescout-help-desk freescout
- 8
- Linux
- 7
- Apple macOS
- 6
- IBM Db2 for Linux, UNIX and Windows
- 3
- MICI Network Co. NetFax Server
- 3
- chshcms mccms
- 2
- Consilium Safety CS5000 Fire Panel
- 2
- mcp-markdownify-server
- 2
- vllm-project vllm · vllm
- 2
- zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- 2
Critical 12
- CVE-2025-46352Consilium Safety CS5000 Fire Panel Use of Hard-coded CredentialsConsilium Safety CS5000 Fire Panel
- CVE-2025-41438Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure DefaultConsilium Safety CS5000 Fire Panel
- CVE-2025-1907Instantel Micromate Missing Authentication for Critical FunctionInstantel Micromate
- CVE-2025-30466This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-31263The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-4967Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2025-47933Argo CD allows cross-site scripting on repositories pageargoproj argo-cd · github.com/argoproj/argo-cd +2
- CVE-2025-48336WordPress Course Builder < 3.6.6 - PHP Object Injection VulnerabilityThimPress Course Builder
- CVE-2025-48047MICI Network Co. Ltd. NetFax Server Command InjectionMICI Network Co. NetFax Server
- CVE-2025-3755Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +73
- CVE-2023-41591An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle
- CVE-2025-48748Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.
High 20
- CVE-2025-5307Santesoft Sante DICOM Viewer Pro Out-of-bounds ReadSantesoft Sante DICOM Viewer Pro
- CVE-2025-31189A file quarantine bypass was addressed with additional checks.Apple macOS
- CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scriptsApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-46823OpenMRS has Vulnerability in FHIR2 Module Privilegesopenmrs-module-fhir2
- CVE-2025-48471FreeScout Vulnerable to Arbitrary File Uploadfreescout-help-desk freescout
- CVE-2025-48390FreeScout Vulnerable to Remote Code Execution (RCE)freescout-help-desk freescout
- CVE-2025-48389FreeScout Vulnerable to Deserialization of Untrusted Datafreescout-help-desk freescout
- CVE-2025-5334Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows Devolutions Remote Desktop Manager
- CVE-2025-37998openvswitch: Fix unsafe attribute parsing in output_userspace()Linux
- CVE-2025-37997netfilter: ipset: fix region locking in hash typesLinux
- CVE-2025-37996KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()Linux
- CVE-2025-48045MICI Network Co. Ltd. NetFax Server Default Administrator Credentials DisclosureMICI Network Co. NetFax Server
- CVE-2025-48388FreeScout Has Insufficient Protection Against CRLF-injectionfreescout-help-desk freescout
- CVE-2025-4687Account pre-hijacking through invite misuseTeltonika Networks RMS
- CVE-2025-5276Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() fmcp-markdownify-server
- CVE-2025-5273Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the gemcp-markdownify-server
- CVE-2024-22654tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.
- CVE-2024-51392An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
- CVE-2024-54952MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability.
- CVE-2025-45474maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
Medium, low and unrated 46
- CVE-2025-53321000 Projects Online Notice Board index.php sql injection1000 Projects Online Notice Board
- CVE-2025-5331PCMan FTP Server NLST Command buffer overflowPCMan FTP Server
- CVE-2025-31261A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-31231A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31199A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-31264An authentication issue was addressed with improved state management.Apple macOS
- CVE-2025-31198This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-5330FreeFloat FTP Server RETR Command buffer overflowFreeFloat FTP Server
- CVE-2025-5328chshcms mccms Backups.php restore_del path traversalchshcms mccms
- CVE-2025-5327chshcms mccms Gf.php index server-side request forgerychshcms mccms
- CVE-2025-5326zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 verifyToken deserializationzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- CVE-2025-5325zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template enginezhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- CVE-2025-47288Discourse Policy plugin private group members visiblediscourse-policy
- CVE-2024-49350IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2025-2518IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2025-3050IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2025-32752Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability.Dell ThinOS
- CVE-2025-5324TechPowerUp GPU-Z 0x8000645C IOCTL GPU-Z.sys sub_140001880 memory leakTechPowerUp GPU-Z
- CVE-2025-5323fossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checkingfossasia open-event-server
- CVE-2025-46722vLLM has a Weakness in MultiModalHasher Image Hashing Implementationvllm-project vllm · vllm
- CVE-2025-46570vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channelvllm-project vllm · vllm
- CVE-2025-48475FreeScout Vulnerable to Insufficient Authorizationfreescout-help-desk freescout
- CVE-2025-48474FreeScout Vulnerable to Insufficient Authorizationfreescout-help-desk freescout
- CVE-2025-48473FreeScout Vulnerable to Insufficient Authorizationfreescout-help-desk freescout
- CVE-2025-48472FreeScout Vulnerable to Insufficient Authorizationfreescout-help-desk freescout
- CVE-2025-3913Team Privacy Settings Authorization Bypass in Mattermost ServerMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-5321aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalationaimhubio aim · aim
- CVE-2025-4081TCC Bypass via Dylib Substitution in DaVinci ResolveBlackmagic Design DaVinci Resolve
- CVE-2025-33043SMM buffer IntegrityAMI AptioV
- CVE-2025-5320gradio-app gradio CORS is_valid_origin privilege escalationgradio-app gradio · gradio
- CVE-2025-37999fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()Linux
- CVE-2025-37995module: ensure that kobject_put() is safe for module type kobjectsLinux
- CVE-2025-37994usb: typec: ucsi: displayport: Fix NULL pointer accessLinux
- CVE-2025-37993can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probeLinux
- CVE-2025-48046MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in CleartextMICI Network Co. NetFax Server
- CVE-2025-27151redis-check-aof may lead to stack overflow and potential RCEredis
- CVE-2024-52588Strapi allows Server-Side Request Forgery in Webhook functionstrapi · @strapi/admin
- CVE-2025-5286Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameterboldthemes Bold Page Builder
- CVE-2025-4670Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcodesmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2025-5122Map Block Leaflet <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parametergoiblas Map Block Leaflet
- CVE-2025-4583Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attributehttps://profiles.wordpress.org/smub/ Smash Balloon Instagra…
- CVE-2024-22653yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at section.c.
- CVE-2024-53423An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets.
- CVE-2025-29632Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handl
- CVE-2025-46078HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server
- CVE-2025-46080HuoCMS V3.5.1 has a File Upload Vulnerability.