CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- bg-tek coslat hotspotImproper Authentication in BG-TEK's Coslat Hotspot6.5 Medium
- sechard information technologies sechardAuthentication Bypass in Sechard Information Technologies' SecHard9.0 Critical
- apache druidApache Druid: Server-Side Request Forgery and Cross-Site Scripting5.8 Medium
- webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 moreOrder Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function4.9 Medium
- hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 moreHT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 moreOrder Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2 High
- file away project away, thomstark file away +1 moreFile Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read7.5 High
- webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 moreOrder Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7 Low
- gplsaver np quote request for woocommerceNP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure7.5 High
- webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 moreOrder Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function7.6 High
- kedro-org kedro-org/kedroRemote Code Execution in kedro-org/kedro8.8 High
- binary-husky binary-husky/gpt academic, gpt academic +1 moreCross-Site WebSocket Hijacking in binary-husky/gpt_academic7.6 High
- langgenius dify, langgenius/dify +1 moreServer-Side Request Forgery (SSRF) in langgenius/dify6.5 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreAuthentication Bypass in gaizhenbiao/ChuanhuChatGPT8.1 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreImproper Access Control in gaizhenbiao/chuanhuchatgpt8.1 High
- significant-gravitas significant-gravitas/autogptSSRF Vulnerabilities in significant-gravitas/autogpt6.5 Medium
- berriai berriai/litellm, litellm +1 moreRemote Code Execution in BerriAI/litellm8.8 High
- binary-husky binary-husky/gpt academic, gpt academic +1 moreServer-Side Request Forgery (SSRF) in binary-husky/gpt_academic6.5 Medium
- vanna-ai vanna-ai/vannaSQL Injection in vanna-ai/vanna8.1 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm desktop +1 moreMissing Authentication for Critical Function in mintplex-labs/anything-llm9.8 Critical
- imartinez imartinez/privategpt, pribai privategpt +1 moreDenial of Service in imartinez/privategpt7.5 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 morePath Traversal in mintplex-labs/anything-llm7.2 High
- h2o, h2oai h2oai/h2o-3 +1 moreDenial of Service by ReDOS in h2oai/h2o-37.5 High
- open-webui open-webui/open-webui, openwebui open webui +1 moreCross-site Scripting (XSS) in open-webui/open-webui9.0 Critical
- netease-youdao netease-youdao/qanything, youdao qanything +1 moreLocal File Inclusion in netease-youdao/qanything7.5 High
- aws aws/sagemaker-python-sdkMD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk5.9 Medium
- significant-gravitas significant-gravitas/autogpt, agpt autogpt platform +1 moreSSRF Check Bypass in Requests Utility in significant-gravitas/autogpt7.5 High
- aimhubio aimhubio/aim, aimstack aim +1 moreStored XSS in aimhubio/aim7.2 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreDenial of Service (DoS) in gaizhenbiao/chuanhuchatgpt7.5 High
- infiniflow infiniflow/ragflow, ragflow +1 moreSSRF in infiniflow/ragflow6.5 Medium
- superagi, transformeroptimus transformeroptimus/superagi +1 moreIDOR Vulnerability in transformeroptimus/superagi8.8 High
- modelscope agentscope, modelscope/agentscope +1 moreCORS Vulnerability in modelscope/agentscope7.4 High
- aimhubio aimhubio/aim, aimstack aim +1 moreArbitrary File Deletion via Relative Path Traversal in aimhubio/aim9.1 Critical
- modelscope agentscope, modelscope/agentscope +1 moreStored XSS in modelscope/agentscope6.1 Medium
- binary-husky binary-husky/gpt academic, gpt academic +1 moreImproper Input Validation in binary-husky/gpt_academic6.5 Medium
- danswer-ai danswer-ai/danswer, onyx +1 moreImproper Access Control in danswer-ai/danswer6.5 Medium
- parisneo parisneo/lollms-webui, lollms web ui +1 moreSSRF in parisneo/lollms-webui7.5 High
- infiniflow infiniflow/ragflow, ragflow +1 moreImproper Authentication in infiniflow/ragflow4.3 Medium
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Access Control in lunary-ai/lunary8.8 High
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 morePath Traversal in eosphoros-ai/db-gpt8.2 High
- modelscope agentscope, modelscope/agentscope +1 moreDirectory Traversal in modelscope/agentscope7.5 High
- parisneo parisneo/lollms-webui, lollms web ui +1 moreDenial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui7.1 High
- stitionai stitionai/devikaPath Traversal in stitionai/devika9.1 Critical
- haotian-liu haotian-liu/llava, hliu large language and vision assistant +1 moreDenial of Service in haotian-liu/llava7.5 High
- composio, composiohq composiohq/composio +1 moreUnrestricted File Write and Read in composiohq/composio7.2 High
- aimhubio aimhubio/aim, aimstack aim +1 moreDenial of Service in aimhubio/aim5.9 Medium
- huggingface huggingface/transformers, transformers +1 moreRegular Expression Denial of Service (ReDoS) in huggingface/transformers5.3 Medium
- binary-husky gpt academic, binary-husky/gpt academic +1 moreSSRF in binary-husky/gpt_academic7.7 High
- invoke-ai invoke-ai/invokeaiDenial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai7.5 High
- open-webui open-webui/open-webui, openwebui open webui +1 moreImproper Authentication in open-webui/open-webui7.5 High
- Show moreLoading…