CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- tapandsign technologies tap&sign app, tapandsign tap\&sign +1 moreImproper Authentication in Tapandsign Technologies Tap and Sign App6.5 Medium
- apache ofbizApache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE3.5 Low
- hdfgroup hdf5HDF5 h5 File H5SM.c H5SM_delete heap-based overflow2.3 Low
- mljar plotaiRemote Code Execution in PlotAI9.3 Critical
- assimpOpen Asset Import Library Assimp File BaseImporter.cpp ConvertToUTF8 heap-based overflow5.3 Medium
- assimpOpen Asset Import Library Assimp File ParsingUtils.h GetNextLine stack-based overflow5.3 Medium
- linuxfoundation pytorchPyTorch Quantized Sigmoid Module nnq_Sigmoid initialization2.0 Low
- linuxfoundation pytorchPyTorch Tuple torch.ops.profiler._call_end_callbacks_on_jit_fut memory corruption2.3 Low
tree-sitter-pklcrates.io`tree-sitter-pkl` was removed from crates.io for malicious codeNo score- mmaitre314 picklescanpicklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch5.3 Medium
- mmaitre314 picklescanpicklescan ZIP archive manipulation attack leads to crash5.3 Medium
- beijing zhide intelligent internet technology modern farm digital integrated management systemBeijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System file access6.9 Medium
- laravel frameworkLaravel Reflected XSS via Route Parameter in Debug-Mode Error Page8.0 High
- laravel frameworkLaravel Reflected XSS via Request Parameter in Debug-Mode Error Page8.0 High
- otrsMissing CSRF protection4.8 Medium
- ge vernova b30 multilin, b90 multilin, c30 multilin +16 more +18 moreInsufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices...6.1 Medium
- ge vernova enervista ur setupMissing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup...8.3 High
- ge vernova enervista ur setupUse of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege...8.0 High
- ge vernova enervista ur setupImproper Authentication vulnerability in GE Vernova EnerVista UR Setup allows Authentication...8.0 High
- ge vernova b30 multilin, b90 multilin, c30 multilin +16 more +18 moreAn improper input validation in GE Vernova UR IED family devices from version 7.0 up to 8.60...6.1 Medium
- hgiga c&cm@il, c\&cm\@il +1 moreHGiga C&Cm@il - Stored Cross-Site Scripting5.4 Medium
- gtbabelGtbabel < 6.6.9 - Unauthenticated Admin Account Takeover8.8 High
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification4.3 Medium
- gallagher command centre serverImproper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration...8.7 High
- gallagher milestone integration pluginImproper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP)...7.2 High
- nintex automationIn Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration...4.3 Medium
- nintex automationNintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.8.5 High
- nintex automationNintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to...5.4 Medium
- freepbx apiPassbolt API before 5, if the server is misconfigured (with an incorrect installation process and...2.1 Low
- tianti project tiantitianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user...8.0 High
- canvgcanvg Prototype Pollution vulnerability9.8 Critical
- visicutVisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of...9.8 Critical
- tianti project tiantiA stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute...5.4 Medium
- tianti project tiantitianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user...8.8 High
- changeweb unifiedtransformUnifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.5.4 Medium
- changeweb unifiedtransformUnifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify...4.3 Medium
- changeweb unifiedtransformUnifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance...2.7 Low
- changeweb unifiedtransformIncorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows...8.8 High
- ikm sanchayaAn issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows...7.5 High
- suse opensuse tumbleweedgerbera: Privilege escalation from user gerbera to root because of insecure %post script7.8 High
- redox-os redoxAn issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of...5.5 Medium
- celk saudeA Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows...5.4 Medium
- evisions mapsA reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10...5.4 Medium
- ftcmsftcms edit cross site scripting4.8 Medium
- ftcmsftcms Search ajax_all_lists sql injection5.1 Medium
- dayrui xunruicmsdayrui XunRuiCMS Friendly Links cross site scripting4.8 Medium
- openxeOpenXE Ticket Bearbeiten Page cross site scripting5.1 Medium
- No product listedMage AI insecure default initialization of resource6.3 Medium
- joomlaux jux real estateJoomlaUX JUX Real Estate realties cross site scripting5.3 Medium
- joomlaux jux real estateJoomlaUX JUX Real Estate GET Parameter realties sql injection5.3 Medium
- Show moreLoading…