# CVEs published 2025-05-30

111 CVEs were published on May 30, 2025: 5 critical, 36 high. Days are UTC.

- [CVE-2025-5364](https://cve.now/CVE-2025-5364.md): Campcodes Online Hospital Management System add-patient.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5363](https://cve.now/CVE-2025-5363.md): Campcodes Online Hospital Management System index.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5362](https://cve.now/CVE-2025-5362.md): Campcodes Online Hospital Management System doctor-specilization.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5361](https://cve.now/CVE-2025-5361.md): Campcodes Online Hospital Management System contact.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-48882](https://cve.now/CVE-2025-48882.md): PHPOffice Math allows XXE when processing an XML file in the MathML format (CVSS 8.7, PHPOffice Math · phpoffice/math)
- [CVE-2025-48949](https://cve.now/CVE-2025-48949.md): Navidrome allows SQL Injection via role parameter (CVSS 8.9, navidrome · github.com/navidrome/navidrome)
- [CVE-2025-5360](https://cve.now/CVE-2025-5360.md): Campcodes Online Hospital Management System book-appointment.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-48948](https://cve.now/CVE-2025-48948.md): Navidrome Transcoding Permission Bypass Vulnerability Report (CVSS 7.4, navidrome · github.com/navidrome/navidrome)
- [CVE-2025-48946](https://cve.now/CVE-2025-48946.md): liboqs affected by theoretical design flaw in HQC (CVSS 3.7, open-quantum-safe liboqs)
- [CVE-2025-2503](https://cve.now/CVE-2025-2503.md): An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file (CVSS 6.9, Lenovo PC Manager)
- [CVE-2025-2502](https://cve.now/CVE-2025-2502.md): An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. (CVSS 8.5, Lenovo PC Manager)
- [CVE-2025-2501](https://cve.now/CVE-2025-2501.md): An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. (CVSS 8.5, Lenovo PC Manager)
- [CVE-2025-1479](https://cve.now/CVE-2025-1479.md): An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to ex (CVSS 4.8, Lenovo Legion Space for Legion Go · Lenovo Legion Space for…)
- [CVE-2025-48883](https://cve.now/CVE-2025-48883.md): Chrome PHP is missing encoding in \`CssSelector\` (CVSS 5.3, chrome-php chrome · chrome-php/chrome)
- [CVE-2025-48938](https://cve.now/CVE-2025-48938.md): Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server (CVSS 2.6, cli go-gh · github.com/cli/go-gh/v2)
- [CVE-2025-48885](https://cve.now/CVE-2025-48885.md): application-urlshortener users can create arbitrary pages as long as they have view access to them (CVSS 5.7, xwikisas application-urlshortener)
- [CVE-2025-48944](https://cve.now/CVE-2025-48944.md): vLLM Tool Schema allows DoS via Malformed pattern and type Fields (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-48943](https://cve.now/CVE-2025-48943.md): vLLM allows clients to crash the openai server with invalid regex (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-48942](https://cve.now/CVE-2025-48942.md): vLLM DOS: Remotely kill vllm over http with invalid JSON schema (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-5359](https://cve.now/CVE-2025-5359.md): Campcodes Online Hospital Management System appointment-history.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5358](https://cve.now/CVE-2025-5358.md): PHPGurukul/Campcodes Cyber Cafe Management System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Cyber Cafe Management System · Campcodes Cyber C…)
- [CVE-2025-5054](https://cve.now/CVE-2025-5054.md): Race Condition in Canonical Apport (CVSS 4.7, Canonical Apport)
- [CVE-2025-48887](https://cve.now/CVE-2025-48887.md): vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in \`pythonic\_tool\_parser.py\` (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-5357](https://cve.now/CVE-2025-5357.md): FreeFloat FTP Server PWD Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2023-26226](https://cve.now/CVE-2023-26226.md): A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 (CVSS 7.4, Yandex Browser)
- [CVE-2025-5356](https://cve.now/CVE-2025-5356.md): FreeFloat FTP Server BYE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2024-42191](https://cve.now/CVE-2024-42191.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to COM hijacking (CVSS 6.5, HCL Software HCL Traveler for Microsoft Outlook)
- [CVE-2024-42190](https://cve.now/CVE-2024-42190.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking (CVSS 6.5, HCL Software HCL Traveler for Microsoft Outlook)
- [CVE-2024-23589](https://cve.now/CVE-2024-23589.md): HCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerability (CVSS 6.8, HCL Software HCL Glovius Cloud)
- [CVE-2024-13917](https://cve.now/CVE-2024-13917.md): Intent Injection in Kruger&Matz AppLock application (CVSS 8.3, Kruger&Matz com.pri.applock)
- [CVE-2024-13916](https://cve.now/CVE-2024-13916.md): Exposure of Applications' Encryption PINs in Kruger&Matz AppLock (CVSS 6.9, Kruger&Matz com.pri.applock)
- [CVE-2024-13915](https://cve.now/CVE-2024-13915.md): Unrestricted Access to Exported Service in com.pri.factorytest (CVSS 6.9, Ulefone com.pri.factorytest · Krüger&Matz com.pri.factoryte…)
- [CVE-2024-7097](https://cve.now/CVE-2024-7097.md): Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup (CVSS 4.3, WSO2 Open Banking AM · WSO2 Open Banking KM +5)
- [CVE-2024-7096](https://cve.now/CVE-2024-7096.md): Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw (CVSS 4.2, WSO2 Open Banking IAM · WSO2 Open Banking AM +6)
- [CVE-2025-3611](https://cve.now/CVE-2025-3611.md): Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-3230](https://cve.now/CVE-2025-3230.md): Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server (CVSS 5.4, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-2571](https://cve.now/CVE-2025-2571.md): Google OAuth Authentication Bypass for Converted Bot Accounts (CVSS 4.2, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-1792](https://cve.now/CVE-2025-1792.md): Improper Access Control in Mattermost Channel Member API (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-0602](https://cve.now/CVE-2025-0602.md): Stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Collaborative Industry Innovator)
- [CVE-2025-4983](https://cve.now/CVE-2025-4983.md): Stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes City Referential Manager)
- [CVE-2025-4984](https://cve.now/CVE-2025-4984.md): Stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes City Referential Manager)
- [CVE-2025-4985](https://cve.now/CVE-2025-4985.md): Stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Project Portfolio Manager)
- [CVE-2025-4986](https://cve.now/CVE-2025-4986.md): Stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Product Manager)
- [CVE-2025-4988](https://cve.now/CVE-2025-4988.md): Stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes Multidisciplinary Optimization Engineer)
- [CVE-2025-4989](https://cve.now/CVE-2025-4989.md): Stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Product Manager)
- [CVE-2025-4990](https://cve.now/CVE-2025-4990.md): Stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Product Manager)
- [CVE-2025-4991](https://cve.now/CVE-2025-4991.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Collaborative Industry Innovator)
- [CVE-2025-4992](https://cve.now/CVE-2025-4992.md): Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Service Process Engineer)
- [CVE-2025-48331](https://cve.now/CVE-2025-48331.md): WordPress WooCommerce Orders & Customers Exporter \<= 5.0 - Sensitive Data Exposure Vulnerability (CVSS 7.5, vanquish WooCommerce Orders & Customers Exporter)
- [CVE-2025-4598](https://cve.now/CVE-2025-4598.md): Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump (CVSS 4.7, systemd-coredump · Red Hat Enterprise Linux +4)
- [CVE-2025-2500](https://cve.now/CVE-2025-2500.md): A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. (CVSS 9.1, Hitachi Energy Asset Suite)
- [CVE-2025-1484](https://cve.now/CVE-2025-1484.md): A vulnerability exists in the media upload component of the Asset Suite versions listed below. (CVSS 6.3, Hitachi Energy Asset Suite)
- [CVE-2025-40909](https://cve.now/CVE-2025-40909.md): Perl threads have a working directory race condition where file operations may target unintended paths (CVSS 5.9, perl)
- [CVE-2025-4433](https://cve.now/CVE-2025-4433.md): Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "Us (CVSS 8.7, Devolutions Server)
- [CVE-2025-5190](https://cve.now/CVE-2025-5190.md): Browse As \<= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie (CVSS 8.8, sorich87 Browse As)
- [CVE-2025-4944](https://cve.now/CVE-2025-4944.md): LA-Studio Element Kit for Elementor \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets (CVSS 6.4, choijun LA-Studio Element Kit for Elementor)
- [CVE-2025-4597](https://cve.now/CVE-2025-4597.md): Woo Slider Pro - Drag Drop Slider Builder For WooCommerce \<= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 6.5, bc2018 Woo Slider Pro – Drag Drop Slider Builder For WooCom…)
- [CVE-2025-1763](https://cve.now/CVE-2025-1763.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-5235](https://cve.now/CVE-2025-5235.md): OpenSheetMusicDisplay \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter (CVSS 6.4, OpenSheetMusicDisplay)
- [CVE-2025-5142](https://cve.now/CVE-2025-5142.md): Simple Page Access Restriction \<= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters (CVSS 6.5, pluginsandsnippets Simple Page Access Restriction)
- [CVE-2025-48334](https://cve.now/CVE-2025-48334.md): WordPress Woo Slider Pro \<= 1.12 - Arbitrary Content Deletion Vulnerability (CVSS 6.5, BinaryCarpenter Woo Slider Pro)
- [CVE-2025-48912](https://cve.now/CVE-2025-48912.md): Apache Superset: Improper authorization bypass on row level security via SQL Injection (CVSS 7.1, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2025-4636](https://cve.now/CVE-2025-4636.md): Local Privilege Escalation (CVSS 7.8, JCT Airpointer)
- [CVE-2025-4635](https://cve.now/CVE-2025-4635.md): Remote Code Execution (CVSS 6.6, JCT Airpointer)
- [CVE-2025-4634](https://cve.now/CVE-2025-4634.md): Local File Inclusion (CVSS 4.1, JCT Airpointer)
- [CVE-2025-4633](https://cve.now/CVE-2025-4633.md): Default Credentials (CVSS 6.5, JCT Airpointer)
- [CVE-2025-5236](https://cve.now/CVE-2025-5236.md): NinjaTeam Chat for Telegram \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter (CVSS 6.4, ninjateam WP Telegram Chat Widget)
- [CVE-2025-4431](https://cve.now/CVE-2025-4431.md): Featured Image Plus \<= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update (CVSS 4.3, krasenslavov Featured Image Plus – Bulk Edit Featured Image…)
- [CVE-2025-4943](https://cve.now/CVE-2025-4943.md): LA-Studio Element Kit for Elementor \<= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter (CVSS 6.4, choijun LA-Studio Element Kit for Elementor)
- [CVE-2025-47697](https://cve.now/CVE-2025-47697.md): Client-side enforcement of server-side security issue exists in wivia 5 all versions. (CVSS 6.5, UCHIDA YOKO CO. wivia)
- [CVE-2025-41406](https://cve.now/CVE-2025-41406.md): Cross-site scripting vulnerability exists in wivia 5 all versions. (CVSS 5.4, UCHIDA YOKO CO. wivia)
- [CVE-2025-41385](https://cve.now/CVE-2025-41385.md): An OS Command Injection issue exists in wivia 5 all versions. (CVSS 6.7, UCHIDA YOKO CO. wivia)
- [CVE-2025-48936](https://cve.now/CVE-2025-48936.md): ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection (CVSS 8.1, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2025-48488](https://cve.now/CVE-2025-48488.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6, freescout-help-desk freescout)
- [CVE-2025-48880](https://cve.now/CVE-2025-48880.md): FreeScout has Race Condition When Deleting Users (CVSS 5.1, freescout-help-desk freescout)
- [CVE-2025-48875](https://cve.now/CVE-2025-48875.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6, freescout-help-desk freescout)
- [CVE-2025-48489](https://cve.now/CVE-2025-48489.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6, freescout-help-desk freescout)
- [CVE-2025-48487](https://cve.now/CVE-2025-48487.md): FreeScout Vulnerable to Stored XSS (CVSS 6.0, freescout-help-desk freescout)
- [CVE-2025-48486](https://cve.now/CVE-2025-48486.md): FreeScout Vulnerable to Stored XSS (CVSS 6.1, freescout-help-desk freescout)
- [CVE-2025-48485](https://cve.now/CVE-2025-48485.md): FreeScout Vulnerable to Stored XSS (CVSS 6.1, freescout-help-desk freescout)
- [CVE-2025-48865](https://cve.now/CVE-2025-48865.md): Fabio allows HTTP clients to manipulate custom headers it adds (CVSS 9.1, fabiolb fabio · github.com/fabiolb/fabio)
- [CVE-2025-48492](https://cve.now/CVE-2025-48492.md): GetSimple CMS RCE in Edit component (CVSS 8.6, GetSimpleCMS-CE)
- [CVE-2025-48889](https://cve.now/CVE-2025-48889.md): Gradio Allows Unauthorized File Copy via Path Manipulation (CVSS 5.3, gradio-app gradio · gradio)
- [CVE-2025-4429](https://cve.now/CVE-2025-4429.md): WordPress Gearside Developer Dashboard \<= 1.0.72 - Reflected XSS (CVSS 6.1, Gearside Developer Dashboard)
- [CVE-2025-41235](https://cve.now/CVE-2025-41235.md): CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies (CVSS 8.6, VMware Spring cloud Gateway · org.springframework.cloud:… +1)
- [CVE-2025-48490](https://cve.now/CVE-2025-48490.md): Laravel Rest Api has a Search Validation Bypass (CVSS 6.6, Lomkit laravel-rest-api · lomkit/laravel-rest-api)
- [CVE-2025-4659](https://cve.now/CVE-2025-4659.md): Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms \<= 1.4.4 - Unauthenticated Full Path Disclosure (CVSS 5.3, crmperks Integration for Salesforce and Contact Form 7, WPF…)
- [CVE-2025-5259](https://cve.now/CVE-2025-5259.md): Minimal Share Buttons \<= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter (CVSS 6.4, gonzomir Minimal Share Buttons)
- [CVE-2025-48881](https://cve.now/CVE-2025-48881.md): Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users (CVSS 8.3, valtimo-platform valtimo-backend-libraries · com.ritense… +1)
- [CVE-2025-48484](https://cve.now/CVE-2025-48484.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6, freescout-help-desk freescout)
- [CVE-2025-48483](https://cve.now/CVE-2025-48483.md): FreeScout Stored XSS leads to CSRF (CVSS 6.3, freescout-help-desk freescout)
- [CVE-2025-48482](https://cve.now/CVE-2025-48482.md): FreeScout Has Business Logic Errors (CVSS 5.3, freescout-help-desk freescout)
- [CVE-2025-48481](https://cve.now/CVE-2025-48481.md): FreeScout Has Business Logic Errors (CVSS 6.1, freescout-help-desk freescout)
- [CVE-2025-48480](https://cve.now/CVE-2025-48480.md): FreeScout Has Business Logic Errors (CVSS 7.0, freescout-help-desk freescout)
- [CVE-2025-48479](https://cve.now/CVE-2025-48479.md): FreeScout Has Business Logic Errors (CVSS 8.5, freescout-help-desk freescout)
- [CVE-2025-48478](https://cve.now/CVE-2025-48478.md): FreeScout Has Business Logic Errors (CVSS 7.0, freescout-help-desk freescout)
- [CVE-2025-48477](https://cve.now/CVE-2025-48477.md): FreeScout Has Business Logic Errors (CVSS 7.1, freescout-help-desk freescout)
- [CVE-2025-48476](https://cve.now/CVE-2025-48476.md): FreeScout Has Business Logic Errors (CVSS 7.1, freescout-help-desk freescout)
- [CVE-2025-48491](https://cve.now/CVE-2025-48491.md): Project AI API Key Exposure in Source Code (CVSS 2.7, aryan6673 project-ai)
- [CVE-2025-48381](https://cve.now/CVE-2025-48381.md): CVAT has information disclosure via browsable API (CVSS 5.3, cvat-ai cvat)
- [CVE-2025-48068](https://cve.now/CVE-2025-48068.md): Information exposure in Next.js dev server due to lack of origin verification (CVSS 2.3, vercel next.js · next)
- [CVE-2025-47952](https://cve.now/CVE-2025-47952.md): Traefik allows path traversal using url encoding (CVSS 2.9, traefik · github.com/traefik/traefik +2)
- [CVE-2024-12224](https://cve.now/CVE-2024-12224.md): idna accepts Punycode labels that do not produce any non-ASCII when decoded (CVSS 5.1, servo rust-url · idna)
- [CVE-2020-36846](https://cve.now/CVE-2020-36846.md): IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library (CVSS 9.8, TIMLEGGE IO::Compress::Brotli · brotli +119)
- [CVE-2025-44612](https://cve.now/CVE-2025-44612.md): Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device cre (CVSS 5.9)
- [CVE-2025-44614](https://cve.now/CVE-2025-44614.md): Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in pl (CVSS 7.5)
- [CVE-2025-44619](https://cve.now/CVE-2025-44619.md): Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the networ (CVSS 9.1)
- [CVE-2025-44904](https://cve.now/CVE-2025-44904.md): hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM\_memcpyvv function. (CVSS 8.8)
- [CVE-2025-44905](https://cve.now/CVE-2025-44905.md): hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z\_\_filter\_scaleoffset function. (CVSS 8.8)
- [CVE-2025-44906](https://cve.now/CVE-2025-44906.md): jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c. (CVSS 7.8)
- [CVE-2025-48757](https://cve.now/CVE-2025-48757.md): An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to (CVSS 9.3, Lovable)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.