CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- langgenius dify, langgenius/dify +1 moreAdmin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify7.5 High
- h2o, h2oai h2oai/h2o-3 +1 moreDenial of Service in h2oai/h2o-37.5 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm docker +1 moreImproper Authorization in mintplex-labs/anything-llm4.3 Medium
- serge-chat serge-chat/sergeStored XSS in Serge in serge-chat/serge6.1 Medium
- invoke-ai invoke-ai/invokeaiRemote Code Execution via Model Deserialization in invoke-ai/invokeai9.8 Critical
- modelscope agentscope, modelscope/agentscope +1 moreArbitrary File Download in modelscope/agentscope7.5 High
- apache seata, apache software foundation seata (incubating) +1 morecompression bomb attack in Apache Seata Server4.3 Medium
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server9.8 Critical
- phil age gateAge Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'9.8 Critical
- cm informatics newsSQLi in CM Informatics' CM News9.8 Critical
- clickhouse ossFail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration7.5 High
- xpro addons — 140+ widgets for elementor140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget6.4 Medium
- gunnettmd linkmyposts, unknown link my posts +1 moreLinkMyPosts <= 1.0 - Reflected XSS7.1 High
- dropstr my quotaMy Quota <= 1.0.8 - Reflected XSS7.1 High
- jakehelbig spotbotSpotBot <= 0.1.8 - Reflected XSS7.1 High
- sjehutch passbeemedia web push notificationPassbeemedia Web Push Notifications <= 1.0.0 - Reflected XSS7.1 High
- tiefpunkt meintopfMeintopf <= 0.2.1 - Reflected XSS7.1 High
- mantus667 wp-pmanagerWP Programmmanager <= 1.2 - Reflected XSS7.1 High
- spring securityCVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length7.4 High
- themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 moreEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update5.3 Medium
- themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 moreEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion8.8 High
- smub custom twitter feeds – a tweets widget or x feed widgetCustom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function4.3 Medium
- martmbithi ibankingA cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart...4.8 Medium
- martmbithi ibankingAn arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers...9.8 Critical
- kishanlal hospital management systemA cross-site scripting (XSS) vulnerability in the component /contact.php of Hospital Management...6.1 Medium
- tenda w18e firmwareTenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter...6.5 Medium
- tenda w18e firmwareTenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter...6.5 Medium
- tenda ax12 firmwareTenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function...6.5 Medium
- tenda ax12 firmwareTenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function...7.5 High
- tenda i12 firmwareTenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in...7.5 High
- tenda ac6 firmwareA vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality...7.5 High
- tenda ac8 firmwareTenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter...7.5 High
- descor infocad, infocad fm +1 moreDESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.10.0 Critical
- descor infocad, infocad fm +1 moreDESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.10.0 Critical
- kukufmAn issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data...7.5 High
- dlink dsl-3788 firmwareD-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the...7.5 High
- inflectra spirateamInflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS). A specially crafted SVG...6.1 Medium
- inflectra spirateamInflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the...9.8 Critical
tomcatMageiaUpdated tomcat packages fix security vulnerabilitiesNo score- applioApplio allows SSRF and file write in model_download.py8.8 High
- applioApplio allows SSRF and file write in model_download.py8.8 High
- applioApplio allows SSRF and file write in model_download.py8.8 High
- applioApplio allows SSRF and file write in model_download.py7.7 High
- applioApplio allows unsafe deserialization in infer.py8.9 High
- applioApplio allows unsafe deserialization in model_blender.py8.9 High
- applioApplio allows arbitrary file write in inference.py7.7 High
- applioApplio allows arbitrary file write in train.py7.7 High
- applioApplio allows arbitrary file read in train.py export_pth function7.7 High
- applioApplio allows a DoS in restart.py7.8 High
- applioApplio allows arbitrary file removal in core.py7.8 High
- Show moreLoading…