CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- zitadelZitadel allows User Enumeration by loginname attribute normalization5.3 Medium
- zitadelZitadel Expired JWT Keys Usable for Authorization Grants8.7 High
- jinher oaJinher Network OA NetDiskProperty.aspx sql injection5.3 Medium
- jooby-project joobyjooby-pac4j: deserialization of untrusted data8.8 High
- novastar cx40Novastar CX40 NetFilter Utility netconfig popen command injection5.1 Medium
- rubentd gifplayergifplayer XSS vulnerability6.9 Medium
- netty netty-incubator-codec-quicNetty QUIC hash collision DoS attack5.3 Medium
- novastar cx40Novastar CX40 NetFilter Utility netconfig getopt stack-based overflow5.1 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System edit-category.php sql injection6.9 Medium
- forestblog project forestblogSayski ForestBlog Friend Link cross site scripting5.1 Medium
- vitejs vite, vite vitejs +1 moreVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query5.3 Medium
- forestblog project forestblogSayski ForestBlog search cross site scripting5.1 Medium
- scratch-coding-hutscratch-coding-hut.github.io Login Links Generation vulnerability9.0 Critical
- xorcom completepbxXorcom CompletePBX <= 5.2.35 Reflected Cross-Site Scripting6.1 Medium
- open-emr openemrOpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability6.9 Medium
- xorcom completepbxXorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion8.3 High
- opensecurity mobile security framework, mobsf mobile-security-framework-mobsf +1 moreMobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding4.4 Medium
- xorcom completepbxXorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection8.8 High
- xorcom completepbxXorcom CompletePBX <= 5.2.35 Authenticated File Disclosure6.5 Medium
- zulip, zulip server +1 moreZulip allows the deletion of Custom profile fields by administrators of a different organization2.7 Low
- esafenet cdgESAFENET CDG UserAjax sql injection5.3 Medium
- zulipZulip allows the deletion of organization by administrators of a different organization2.7 Low
- kentico xperienceKentico Xperience <= 13.0.180 Unsafe Reflection8.7 High
- beegoBeego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input9.3 Critical
- open-emr openemrOpenEMR Stored XSS in OpenEMR Bronchitis Form8.4 High
- open-emr openemrOpenEMR Reflected XSS in AJAX Script6.4 Medium
- open-emr openemrOpenEMR allows Reflected XSS in CAMOS new.php7.2 High
- rockwell automation verve asset managerAdmin Shell Access Vulnerability in Rockwell Automation Verve Asset Manager7.5 High
- digital china dcme-520Digital China DCME-520 mon_merge_stat_hist.php os command injection6.9 Medium
- enalean tuleapTuleap does not enforce read permissions on parent trackers in the REST API4.3 Medium
- enalean tuleapTuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin5.3 Medium
- enalean tuleapTuleap allows XSS via the content of RSS feeds in the RSS widgets4.8 Medium
- enalean tuleapTuleap is missing CSRF protection on tracker hierarchy administration4.6 Medium
- enalean tuleapTuleap has missing CSRF protections on artifact submission & edition from the tracker view4.6 Medium
- zulip, zulip server +1 moreZulip exports can leak private data4.6 Medium
- linuxfoundation pytorchPyTorch torch.lstm_cell memory corruption4.8 Medium
- aws serverless application model command line interfacePath Traversal in AWS SAM CLI allows file copy to local cache6.9 Medium
- aws serverless application model command line interfacePath Traversal in AWS SAM CLI allows file copy to build container6.9 Medium
- fit2cloud jumpserverJumpServer has a Kubernetes Token Leak Vulnerability4.3 Medium
- linuxfoundation pytorchPyTorch torch.jit.script memory corruption4.8 Medium
- fortinet fortimail, fortindr +1 moreA buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail...4.5 Medium
- linuxfoundation pytorchPyTorch torch.nn.utils.rnn.unpack_sequence memory corruption4.8 Medium
- black duck coverityStored Cross-Site Scripting8.5 High
- linuxfoundation pytorchPyTorch torch.nn.utils.rnn.pad_packed_sequence memory corruption4.8 Medium
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu url server-side request forgery5.3 Medium
- canonical linux-bluefield, ubuntu package linux-bluefield +1 moreDDoS in Ubuntu package linux-bluefield7.5 High
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface SysToolDDNS access control6.9 Medium
- jacob allred infusionsoft web form javascriptWordPress Infusionsoft Web Form JavaScript plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david lingren media library assistantWordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerability5.9 Medium
- ramanparashar useinfluenceWordPress Useinfluence plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- Show moreLoading…