CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- pixelfedPixelfed may allow unauthorized actor to view private posts and private users4.3 Medium
- No product listedAn issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to...7.5 High
- tiny moxiemanager phpIn Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command....9.4 Critical
- d-link dir-823x, dlink dir-823x firmware +1 moreA command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized...7.2 High
- arm mbed tls, mbed mbedtls +1 moreMbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or...5.4 Medium
- arm mbed tls, mbed mbedtls +1 moreMbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have...5.4 Medium
- nasa core flight systemIn NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state...7.5 High
- nasa core flight systemThe Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions,...9.8 Critical
- nasa core flight systemNASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious...7.5 High
- nasa core flight systemNASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing...7.5 High
- nasa fprimeA command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows...9.8 Critical
- nasa fprimeNASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.6.1 Medium
- nasa fprimeA template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to...9.8 Critical
- No product listedAn issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to...9.8 Critical
- sirsidynix ipac20SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382;...7.5 High
- No product listedSQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2...9.8 Critical
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X HTTP POST Request diag_nslookup sub_41710C os command injection5.1 Medium
- kubernetes ingress-nginxingress-nginx controller - configuration injection via unsanitized auth-url annotation8.8 High
- kubernetes ingress-nginxingress-nginx controller - auth secret file path traversal vulnerability4.8 Medium
- kubernetes ingress-nginxingress-nginx controller - configuration injection via unsanitized mirror annotations8.8 High
- kubernetes ingress-nginxingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation8.8 High
- kubernetes ingress-nginxingress-nginx admission controller RCE escalation9.8 Critical
- china mobile p22g-ciacChina Mobile P22g-CIac Samba Path path traversal5.1 Medium
- timschofield weberptimschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scripting5.1 Medium
- netapp snapcenterCVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter9.9 Critical
- joomlaux jux real estateJoomlaUX JUX Real Estate addagent cross site scripting5.3 Medium
- yonyou ufida erp-ncYonyou UFIDA ERP-NC top.jsp cross site scripting5.3 Medium
- yonyou ufida erp-ncYonyou UFIDA ERP-NC systop.jsp cross site scripting5.3 Medium
- yonyou ufida erp-ncYonyou UFIDA ERP-NC menu.jsp cross site scripting5.3 Medium
- yonyou ufida erp-ncYonyou UFIDA ERP-NC login.jsp cross site scripting5.3 Medium
- pdf-xchange editor, pdf-tools +1 morePDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- iocoder ruoyi-vue-prozhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal5.3 Medium
- iocoder ruoyi-vue-prozhijiantianya ruoyi-vue-pro Front-End Store upload path traversal5.3 Medium
- ciliumNode based network policies may incorrectly allow workload traffic3.4 Low
- ciliumEast-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers3.2 Low
- aureus erpDigiwin ERP UploadAjaxAPI.ashx unrestricted upload5.3 Medium
- kentico xperienceKentico Xperience stored cross-site scripting in multiple-file upload functionality6.1 Medium
- kentico xperienceKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE7.2 High
- kentico xperience, xperience cms +1 moreKentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass9.8 Critical
- kentico xperience, xperience cms +1 moreKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass9.8 Critical
- spring securitySpring Security Vulnerable to Authorization Bypass via Security Annotations5.3 Medium
- vitejs viteVite bypasses server.fs.deny when using `?raw??`5.3 Medium
- oddlama kanidm-provisionkanidm-provision leaks provisioned admin credentials into the system log7.6 High
- kyvernoKyverno ignores subjectRegExp and IssuerRegExp5.8 Medium
- hcl software devops deploy / hcl launch, hcltechsw hcl devops deploy, hcl launch +2 moreHCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability7.2 High
- forcepoint email securityPersistent XSS in blocked messages6.1 Medium
- aureus erpDigiwin ERP FileUploadApi.ashx DoWebUpload unrestricted upload6.9 Medium
- api-platform coreGraphQl securityAfterResolver not called4.4 Medium
aws-cdk-libnpmAWS CDK CodePipeline: trusted entities are too broad3.8 Low- fortinet fortios, fortios-6k7k, fortiproxy +5 more +7 moreA buffer underwrite ('buffer underflow') vulnerability in the administrative interface of...9.3 Critical
- Show moreLoading…