CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- digitaldruid hoteldruidA CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to...7.3 High
- digitaldruid hoteldruidCross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to...5.4 Medium
- lsc ptz dual band camera firmwareLSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the...7.7 High
- microsoft asp.net core, asp.net core 8.0, asp.net core 9.0 +5 more +7 moreASP.NET Core and Visual Studio Elevation of Privilege Vulnerability7.0 High
- datalust seqAn issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth...5.7 Medium
- zucchetti ad hoc infinityCross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated...5.4 Medium
- zucchetti ad hoc infinityIn Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to...7.6 High
- zucchetti ad hoc infinityCross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated...5.4 Medium
- zucchetti ad hoc infinityA local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows...7.3 High
- librasean ip-utilsThe ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such...2.9 Low
- abocms abo.cmsThe unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a...6.5 Medium
- perl crypt::random, timlegge crypt\ +1 morePerl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions8.8 High
- rackLocal File Inclusion in Rack::Static7.5 High
- concrete cms cms, concretecms concrete cms +1 moreStored XSS in Folder Function by Rogue Admin4.8 Medium
- google androidIn wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a...7.8 High
- google androidIn dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow...8.4 High
- google chromeOut of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to...8.8 High
- google chromeUse after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to...8.8 High
- pmmp pocketmine-mpPocketMine-MP before 5.25.2 Denial of Service via explode6.9 Medium
- apple ipados, macos, watchos +2 more +4 moreThis issue was addressed through improved state management. This issue is fixed in macOS Ventura...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreA double free issue was addressed with improved memory management. This issue is fixed in macOS...7.8 High
- apple ipados, macos, ios and ipados +1 more +3 moreA clickjacking issue was addressed with improved out-of-process view handling. This issue is...2.8 Low
- apple ipados, macos, safari +5 more +7 moreA cookie management issue was addressed with improved state management. This issue is fixed in...6.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThis issue was addressed by restricting options offered on a locked device. This issue is fixed...2.4 Low
- apple ipados, macos, ios and ipados +1 more +3 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS...7.5 High
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15....7.5 High
- apple macosThis issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreA logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18,...5.5 Medium
- apple macos, safari, tvos +4 more +6 moreThe issue was addressed with improved checks. This issue is fixed in watchOS 11, macOS Sequoia 15...5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7, macOS...5.5 Medium
- apple macosThis issue was addressed with improved redaction of sensitive information. This issue is fixed in...5.5 Medium
- devolutions serverVela Server has Insufficient Webhook Payload Data Verification8.6 High
- umati umatigatewayumatiGateway's UI publicly accessible in provided docker-compose file8.2 High
io.github.robothy:local-s3-restMavenLocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection6.9 Mediumio.github.robothy:local-s3-restMavenLocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API6.9 Mediumio.github.robothy:local-s3-restMavenLocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection6.9 Medium- robothy local-s3LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection5.5 Medium
- misskeyMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes9.3 Critical
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT SSRF vulnerability7.7 High
- hashicorp nomad, nomad enterprise +1 moreNomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs6.5 Medium
- lf-edge ekuiperLF Edge eKuiper has Stored XSS in Rules Functionality5.4 Medium
- apache tomcat, debian linux, netapp bootstrap os +2 moreApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT9.8 Critical
- ibm sterling b2b integrator standard edition, sterling b2b integrator +1 moreIBM Sterling B2B Integrator information disclosure2.7 Low
- ibm sterling file gatewayIBM Sterling File Gateway information disclosure5.3 Medium
- freshface fresh frameworkWordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerability10.0 Critical
- nitin prakash wc place order without paymentWordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerability7.5 High
- epc massive dynamicWordPress Massive Dynamic theme <= 8.2 - Unauthenticated Local File Inclusion vulnerability9.0 Critical
- iqonic wpbookitWordPress WPBookit plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- Show moreLoading…