CVEs published May 30, 2025
111 CVEs were published on May 30, 2025: 5 critical, 36 high.
- Published
- 111
- Critical
- 5
- High
- 36
- Medium
- 63
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 57
Most affected products
- freescout-help-desk freescout
- 16
- Campcodes Online Hospital Management System
- 6
- JCT Airpointer
- 4
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 4
- vllm-project vllm · vllm
- 4
- Dassault Systèmes Product Manager
- 3
- Lenovo PC Manager
- 3
- UCHIDA YOKO CO. wivia
- 3
- choijun LA-Studio Element Kit for Elementor
- 2
- Dassault Systèmes City Referential Manager
- 2
Critical 5
- CVE-2025-2500A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below.Hitachi Energy Asset Suite
- CVE-2025-48865Fabio allows HTTP clients to manipulate custom headers it addsfabiolb fabio · github.com/fabiolb/fabio
- CVE-2020-36846IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C libraryTIMLEGGE IO::Compress::Brotli · brotli +119
- CVE-2025-44619Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the networ
- CVE-2025-48757An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write toLovable
High 36
- CVE-2025-48882PHPOffice Math allows XXE when processing an XML file in the MathML formatPHPOffice Math · phpoffice/math
- CVE-2025-48949Navidrome allows SQL Injection via role parameternavidrome · github.com/navidrome/navidrome
- CVE-2025-48948Navidrome Transcoding Permission Bypass Vulnerability Reportnavidrome · github.com/navidrome/navidrome
- CVE-2025-2502An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.Lenovo PC Manager
- CVE-2025-2501An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.Lenovo PC Manager
- CVE-2023-26226A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682Yandex Browser
- CVE-2024-13917Intent Injection in Kruger&Matz AppLock applicationKruger&Matz com.pri.applock
- CVE-2025-0602Stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xDassault Systèmes Collaborative Industry Innovator
- CVE-2025-4983Stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025xDassault Systèmes City Referential Manager
- CVE-2025-4984Stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025xDassault Systèmes City Referential Manager
- CVE-2025-4985Stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes Project Portfolio Manager
- CVE-2025-4986Stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes Product Manager
- CVE-2025-4988Stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes Multidisciplinary Optimization Engineer
- CVE-2025-4989Stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes Product Manager
- CVE-2025-4990Stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes Product Manager
- CVE-2025-4991Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes Collaborative Industry Innovator
- CVE-2025-4992Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025xDassault Systèmes Service Process Engineer
- CVE-2025-48331WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerabilityvanquish WooCommerce Orders & Customers Exporter
- CVE-2025-4433Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "UsDevolutions Server
- CVE-2025-5190Browse As <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookiesorich87 Browse As
- CVE-2025-1763Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-48912Apache Superset: Improper authorization bypass on row level security via SQL InjectionApache Software Foundation Apache Superset · apache-superset
- CVE-2025-4636Local Privilege EscalationJCT Airpointer
- CVE-2025-48936ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injectionzitadel · github.com/zitadel/zitadel +1
- CVE-2025-48492GetSimple CMS RCE in Edit componentGetSimpleCMS-CE
- CVE-2025-41235CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted ProxiesVMware Spring cloud Gateway · org.springframework.cloud:… +1
- CVE-2025-48881Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized usersvaltimo-platform valtimo-backend-libraries · com.ritense… +1
- CVE-2025-48480FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-48479FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-48478FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-48477FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-48476FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-44614Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in pl
- CVE-2025-44904hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.
- CVE-2025-44905hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.
- CVE-2025-44906jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.
Medium, low and unrated 70
- CVE-2025-5364Campcodes Online Hospital Management System add-patient.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5363Campcodes Online Hospital Management System index.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5362Campcodes Online Hospital Management System doctor-specilization.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5361Campcodes Online Hospital Management System contact.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5360Campcodes Online Hospital Management System book-appointment.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-48946liboqs affected by theoretical design flaw in HQCopen-quantum-safe liboqs
- CVE-2025-2503An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file Lenovo PC Manager
- CVE-2025-1479An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to exLenovo Legion Space for Legion Go · Lenovo Legion Space for…
- CVE-2025-48883Chrome PHP is missing encoding in `CssSelector`chrome-php chrome · chrome-php/chrome
- CVE-2025-48938Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Servercli go-gh · github.com/cli/go-gh/v2
- CVE-2025-48885application-urlshortener users can create arbitrary pages as long as they have view access to themxwikisas application-urlshortener
- CVE-2025-48944vLLM Tool Schema allows DoS via Malformed pattern and type Fieldsvllm-project vllm · vllm
- CVE-2025-48943vLLM allows clients to crash the openai server with invalid regexvllm-project vllm · vllm
- CVE-2025-48942vLLM DOS: Remotely kill vllm over http with invalid JSON schemavllm-project vllm · vllm
- CVE-2025-5359Campcodes Online Hospital Management System appointment-history.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5358PHPGurukul/Campcodes Cyber Cafe Management System bwdates-reports-details.php sql injectionPHPGurukul Cyber Cafe Management System · Campcodes Cyber C…
- CVE-2025-5054Race Condition in Canonical ApportCanonical Apport
- CVE-2025-48887vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`vllm-project vllm · vllm
- CVE-2025-5357FreeFloat FTP Server PWD Command buffer overflowFreeFloat FTP Server
- CVE-2025-5356FreeFloat FTP Server BYE Command buffer overflowFreeFloat FTP Server
- CVE-2024-42191HCL Traveler for Microsoft Outlook (HTMO) is susceptible to COM hijackingHCL Software HCL Traveler for Microsoft Outlook
- CVE-2024-42190HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijackingHCL Software HCL Traveler for Microsoft Outlook
- CVE-2024-23589HCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerabilityHCL Software HCL Glovius Cloud
- CVE-2024-13916Exposure of Applications' Encryption PINs in Kruger&Matz AppLockKruger&Matz com.pri.applock
- CVE-2024-13915Unrestricted Access to Exported Service in com.pri.factorytestUlefone com.pri.factorytest · Krüger&Matz com.pri.factoryte…
- CVE-2024-7097Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupWSO2 Open Banking AM · WSO2 Open Banking KM +5
- CVE-2024-7096Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawWSO2 Open Banking IAM · WSO2 Open Banking AM +6
- CVE-2025-3611Improper Access Control in Mattermost allows System Managers to view team details despite role restrictionsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-3230Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-2571Google OAuth Authentication Bypass for Converted Bot AccountsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-1792Improper Access Control in Mattermost Channel Member APIMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-4598Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dumpsystemd-coredump · Red Hat Enterprise Linux +4
- CVE-2025-1484A vulnerability exists in the media upload component of the Asset Suite versions listed below.Hitachi Energy Asset Suite
- CVE-2025-40909Perl threads have a working directory race condition where file operations may target unintended pathsperl
- CVE-2025-4944LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgetschoijun LA-Studio Element Kit for Elementor
- CVE-2025-4597Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionbc2018 Woo Slider Pro – Drag Drop Slider Builder For WooCom…
- CVE-2025-5235OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterOpenSheetMusicDisplay
- CVE-2025-5142Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameterspluginsandsnippets Simple Page Access Restriction
- CVE-2025-48334WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion VulnerabilityBinaryCarpenter Woo Slider Pro
- CVE-2025-4635Remote Code ExecutionJCT Airpointer
- CVE-2025-4634Local File InclusionJCT Airpointer
- CVE-2025-4633Default CredentialsJCT Airpointer
- CVE-2025-5236NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameterninjateam WP Telegram Chat Widget
- CVE-2025-4431Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Updatekrasenslavov Featured Image Plus – Bulk Edit Featured Image…
- CVE-2025-4943LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameterchoijun LA-Studio Element Kit for Elementor
- CVE-2025-47697Client-side enforcement of server-side security issue exists in wivia 5 all versions.UCHIDA YOKO CO. wivia
- CVE-2025-41406Cross-site scripting vulnerability exists in wivia 5 all versions.UCHIDA YOKO CO. wivia
- CVE-2025-41385An OS Command Injection issue exists in wivia 5 all versions.UCHIDA YOKO CO. wivia
- CVE-2025-48488FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48880FreeScout has Race Condition When Deleting Usersfreescout-help-desk freescout
- CVE-2025-48875FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48489FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48487FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48486FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48485FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48889Gradio Allows Unauthorized File Copy via Path Manipulationgradio-app gradio · gradio
- CVE-2025-4429WordPress Gearside Developer Dashboard <= 1.0.72 - Reflected XSSGearside Developer Dashboard
- CVE-2025-48490Laravel Rest Api has a Search Validation BypassLomkit laravel-rest-api · lomkit/laravel-rest-api
- CVE-2025-4659Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosurecrmperks Integration for Salesforce and Contact Form 7, WPF…
- CVE-2025-5259Minimal Share Buttons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parametergonzomir Minimal Share Buttons
- CVE-2025-48484FreeScout Vulnerable to Stored XSSfreescout-help-desk freescout
- CVE-2025-48483FreeScout Stored XSS leads to CSRFfreescout-help-desk freescout
- CVE-2025-48482FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-48481FreeScout Has Business Logic Errorsfreescout-help-desk freescout
- CVE-2025-48491Project AI API Key Exposure in Source Codearyan6673 project-ai
- CVE-2025-48381CVAT has information disclosure via browsable APIcvat-ai cvat
- CVE-2025-48068Information exposure in Next.js dev server due to lack of origin verificationvercel next.js · next
- CVE-2025-47952Traefik allows path traversal using url encodingtraefik · github.com/traefik/traefik +2
- CVE-2024-12224idna accepts Punycode labels that do not produce any non-ASCII when decodedservo rust-url · idna
- CVE-2025-44612Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device cre