CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- applioApplio allows arbitrary file read in train.py export_index function7.7 High
- applioApplio allows unsafe deserialization in inference.py8.9 High
- applioApplio allows unsafe deserialization in model_information.py8.9 High
- absolute security secure accessThere is a cross-site scripting vulnerability in the Secure Access administrative console of...5.5 Medium
- absolute security secure accessThere is a cross-site scripting vulnerability in the Secure Access administrative console of...5.5 Medium
- @clerk nuxtNuxt allows DOS via cache poisoning with payload rendering response7.5 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)5.1 Medium
- google chromeUse after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to...8.8 High
- drupal formatter suite, formatter suite project suite +1 moreFormatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-0266.1 Medium
- chapterthree rapidoc oas field formatterRapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-0256.1 Medium
- drupal link field display mode formatterLink field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-0246.1 Medium
- red hat openshift container platform 3.11, openshift container platform 4 +1 moreOpenshift-console: openshift console: path traversal4.3 Medium
- ibm infosphere information serverIBM InfoSphere Server Information command execution8.4 High
github.com/openshift/hiveGo,govulncheck-vulndbopenSUSE +1 moreOpenshift-dedicated: hive: hibernation controller denial of service4.3 Medium- xwiki, xwiki xwiki-platform +1 moreThe WikiManager REST API allows any user to create wikis7.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki allows unregistered users to access private pages information through REST endpoint8.7 High
- xwiki, xwiki xwiki-platform +1 moreXWiki uses the wrong wiki reference in AuthorizationManager8.7 High
- proofpoint enterprise protectionEnterprise Protection Backslash URL Rewrite Bypass5.8 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- getkin kin-openapiImproper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter7.5 High
- sylius paypalpluginSylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout6.5 Medium
- beta80 life 1stUse of a Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient...6.0 Medium
- nearform fast-jwtFast-JWT Improperly Validates iss Claims6.5 Medium
- jenkins zoho qengine, jenkins project zoho qengine plugin +1 moreJenkins Zoho QEngine Plugin Displays Unmasked API Keys3.1 Low
- jenkins anchorchain, jenkins project anchorchain plugin +1 moreJenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability6.5 Medium
- vllmvLLM Allows Remote Code Execution via Mooncake Integration9.1 Critical
- vllmvLLM denial of service via outlines unbounded cache on disk6.5 Medium
- progress loadmaster, multi-tenant loadmaster +1 moreImproper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue...4.3 Medium
- beta80 life 1stThe Exposure of Sensitive Information to an Unauthorized Actor vulnerability impacting Beta80...5.8 Medium
- progress moveit transferA MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder5.9 Medium
- dell secure connect gateway (scg) 5.0 appliance - srs, secure connect gateway +1 moreDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of...5.5 Medium
- reviewdog action-ast-grep, action-composite-template, action-setup +5 more +7 moreMultiple Reviewdog actions were compromised during a specific time period8.6 High
- dell secure connect gateway (scg) 5.0 appliance - srs, secure connect gateway +1 moreDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore...5.5 Medium
- hcl software myxalytics, hcltech dryice myxalytics +1 moreHCL MyXalytics is affected by concurrent login vulnerability2.6 Low
- mattermost, mattermost server +1 moreUnauthorized View Access to Site Statistics and Team Statistics4.3 Medium
- file away project away, thomstark file away +1 moreFile Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function9.8 Critical
- ibm security reaqta, security qradar edr +1 moreIBM Security ReaQta file upload4.7 Medium
- mitchelllevy ahathat pluginAHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter4.9 Medium
- chimpstudio foodbakery | delivery restaurant directory wordpress themeFoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions8.8 High
- chimpstudio foodbakery | delivery restaurant directory wordpress themeFoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions8.8 High
- aonetheme service finder bookingsService Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +1 moreApache Airflow MySQL Provider: SQL injection in MySQL provider core function6.3 Medium
- elfatek elektronics anka jpd-00028, elfatek anka jpd00028 firmware +1 moreImproper Access Control in Elfatek Elektronics' ANKA JPD-000286.9 Medium
- elfatek elektronics anka jpd-00028Authentication Bypass in Elfatek Elektronics' ANKA JPD-000287.6 High
- thememove minimogwp – the high converting ecommerce wordpress themeMinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion9.8 Critical
- loftocean cozystay - hotel booking wordpress themeCozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler7.5 High
- loftocean cozystay - hotel booking wordpress theme, tinysalt - personal food blog wordpress theme +1 moreCozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler9.8 Critical
- Show moreLoading…