CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- jozoor shortcode cleaner liteShortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export6.5 Medium
- hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 moreHT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget6.4 Medium
qcpcrates.ioqcp has possible crash/DOS in some build configurations6.9 Medium- espressif esp32, esp32 firmware +1 moreEspressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).6.8 Medium
- mozilla thunderbirdCrafted email message incorrectly shown as being encrypted7.0 High
- mozilla thunderbirdDownloading of OpenPGP keys from WKD used incorrect padding5.3 Medium
- mariadbMariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN:...4.9 Medium
- mariadbMariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0....4.9 Medium
- mariadbMariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through...4.9 Medium
- mariadbMariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11...4.9 Medium
- totolink ex1800t, ex1800t firmware +1 moreTOTOLINK EX1800T cstecgi.cgi setRptWizardCfg stack-based overflow8.7 High
- totolink ex1800t, ex1800t firmware +1 moreTOTOLINK EX1800T cstecgi.cgi setRebootScheCfg os command injection5.3 Medium
- totolink ex1800t, ex1800t firmware +1 moreTOTOLINK EX1800T cstecgi.cgi setDmzCfg os command injection5.3 Medium
- totolink ex1800t, ex1800t firmware +1 moreTOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig os command injection5.3 Medium
- code-projects online library management systemPHPGurukul Online Library Management System change-password.php password recovery2.3 Low
github.com/strangelove-ventures/horcruxGo,github.com/strangelove-ventures/horcrux/v3Go +1 moreHorcrux Double Sign Possibility8.7 High- trimble sketchupTrimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability7.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- ibm control centerIBM Control Center external service interaction5.3 Medium
- ibm control center, sterling control center +1 moreIBM Control Center HOST header injection5.4 Medium
- silabs.com simplicity sdkSilicon Labs CPC can leak information in full duplex SPI1.0 Low
- ibm aspera sharesIBM Aspera Shares XML external entity injection7.1 High
- microsoft windbgWinDbg Remote Code Execution Vulnerability7.5 High
- nhairs python-json-logger, python json logger +1 morePython JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependency8.8 High
- qnap qurouterQHora5.1 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero2.1 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero2.1 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero2.1 Low
- qnap qts, qulog center, quts hero +2 moreQuLog Center5.1 Medium
- qnap hybrid backup sync, qnap systems inc. hbs 3 hybrid backup sync +1 moreHBS 3 Hybrid Backup Sync6.3 Medium
- qnap systems inc. qfinder pro mac, qsync for mac, qvpn device client for mac +2 moreQVPN Device Client, Qsync, Qfinder Pro8.6 High
- qnap qts, quts hero +1 moreQTS, QuTS hero7.1 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.1 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero5.1 Medium
- gfi software helpdeskHelpdesk7.7 High
- qnap qurouterQHora7.7 High
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 55.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero2.1 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero5.3 Medium
- xwiki confluence migrator, xwikisas application-confluence-migrator-pro +1 moreXWiki Confluence Migrator Pro's homepage is public7.5 High
- xwikisas application-confluence-migrator-proXWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations9.1 Critical
- intlify vue-i18nVue I18n Prototype Pollution in `handleFlatJson`8.9 High
- truefoundry cognitaCognita CORS misconfiguration in backend API server6.9 Medium
- truefoundry cognitaCognita Arbitrary File Write9.3 Critical
- axiosPossible SSRF and Credential Leakage via Absolute URL in axios Requests7.7 High
- phpgurukul pre-school enrollment systemPHPGurukul Pre-School Enrollment System Sub Admin add-subadmin.php access control5.1 Medium
- starsea99 starsea-mallStarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control5.3 Medium
- phpgurukul pre-school enrollment systemPHPGurukul Pre-School Enrollment System profile.php sql injection6.9 Medium
- starsea99 starsea-mallStarSea99 starsea-mall update cross site scripting5.1 Medium
- starsea99 starsea-mallStarSea99 starsea-mall update cross site scripting5.1 Medium
- Show moreLoading…