CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- davidosipov postquantum-feldman-vssPost-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`5.4 Medium
- node-saml xml-cryptoxml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment9.3 Critical
- node-saml xml-cryptoxml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References9.3 Critical
- element, element-hq element-android +1 moreElement Android PIN autologout bypass5.1 Medium
- fortinet fortiwebAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7...5.5 Medium
- leica biosystems aperio eslide managerReflected Cross Site Scripting in Aperio Eslide Manager4.6 Medium
- fortinet fortinac-fAn improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below...4.4 Medium
- fortinet fortinacA improper neutralization of special elements used in a command ('command injection') in Fortinet...4.8 Medium
- fortinet forticlient, forticlientmac +1 moreAn external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3...7.8 High
- fortinet fortianalyzer, fortimanager +1 moreAn insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager...5.9 Medium
- fortinet fortiwebAn improper neutralization of special elements used in an SQL command ('SQL Injection')...2.6 Low
- fortinet fortindrAn improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2...6.0 Medium
- fortinet fortimanager, fortimanager cloud +1 moreA improper neutralization of special elements used in a command ('command injection') in Fortinet...8.3 High
- fortinet fortiportalAn improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version...4.4 Medium
- ibm qradar edr, security qradar edr +1 moreIBM QRadar EDR information disclosure4.1 Medium
- ibm qradar edr, security qradar edr +1 moreIBM QRadar EDR information disclosure5.9 Medium
- debian linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenetfilter: allow exp not to be removed in nf_ct_find_expectation7.8 High
- hp laserjet mfp m232-m237 printer series, 1y7d4a firmware, 2a129a firmware +52 more +54 moreHP LaserJet MFP M232-M237 Printer Series - Potential Denial of Service6.9 Medium
- demergent-labs azleAzle calling `setTimer` causes infinite loop of timers8.7 High
- ibm qiskit, qiskit sdk +1 moreQiskit SDK code execution9.8 Critical
- sick ag dl100-2xxxxxxxWeak hashing alghrythm9.8 Critical
- sick ag dl100-2xxxxxxxUnencrypted transmission of password hash7.5 High
- glpi-project glpi-inventory-pluginGLPI Inventory Plugin vulnerable to reflective Cross-site Scripting6.5 Medium
- sick ag dl100-2xxxxxxxRCE due to Device Driver9.3 Critical
- owen2345 camaleon-cmsCamaleon CMS Privilege Escalation9.4 Critical
- uxper civi, civi - job board & freelance marketplace wordpress theme +1 moreCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure7.3 High
- uxper civi, civi - job board & freelance marketplace wordpress theme +1 moreCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass5.6 Medium
- purethemes realteoRealteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'9.8 Critical
- uxper civi, civi - job board & freelance marketplace wordpress theme +1 moreCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update9.8 Critical
- chimpgroup jobcareerJobCareer | Job Board Responsive WordPress Theme <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions8.8 High
- fortinet fortios, fortiproxy +1 moreAn improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS...6.9 Medium
- sharethis dashboard for google analyticsShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation5.3 Medium
- red hat devworkspace operator 0.33, discovery 1.14, enterprise linux 10 +26 more +28 moreLibexpat: expat: improper restriction of xml entity expansion depth in libexpat7.5 High
- omnipressteam omnipressOmnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- detheme dethemekit for elementorDethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- analyticswpAnalyticsWP <= 2.0.0 - Unauthenticated SQL Injection7.5 High
- potenzaglobalsolutions ciyashop, ciyashop - multipurpose woocommerce theme +1 moreCiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection9.8 Critical
- whyun wpcom member, wpcom member +1 moreWPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection7.5 High
- irontemplates soundrise, soundrise music +1 moreSoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- instawp connect – 1-click wp staging & migrationInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion8.8 High
- cmsmasters eco nature - environment & ecology wordpress themeEco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update8.1 High
- anps industrialIndustrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- zozothemes zegen, zegen - church wordpress theme +1 moreZegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates4.3 Medium
- hiddenpearls loginpress | wp-login custom login page customizerLoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update7.5 High
- johndarrel wp ghost (hide my wp ghost) – security & firewall, wpplugins hide my wp ghost +1 moreWP Ghost <= 5.4.01 - Unauthenticated Limited File Read7.5 High
- beeteam368 vidorev extensionsVidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import5.3 Medium
- chimpgroup jobcareerWP JobHunt <= 7.1 - Authentication Bypass to Candidate7.5 High
- creativemindssolutions cm faq – simplify support with an intuitive faq management toolCM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting6.1 Medium
- chimpgroup jobcareerWP JobHunt <= 7.1 - Authentication Bypass9.8 Critical
- search & filter proSearch and filter pro <= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure4.3 Medium
- Show moreLoading…