CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- jenkins monitor-remote-job, jenkins project monitor-remote-job plugin +1 moreJenkins monitor-remote-job Plugin Stores Passwords Unencrypted5.5 Medium
- jenkins cadence vmanager, jenkins project cadence vmanager plugin +1 moreJenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted4.3 Medium
- jenkins simple queue, jenkins project simple queue plugin +1 moreJenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)4.3 Medium
- jenkins templating engine, jenkins project templating engine plugin +1 moreJenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution8.8 High
- jenkinsJenkins Missing Permission Check4.3 Medium
- jenkinsJenkins Missing Permission Check4.3 Medium
- ibm jazz reporting serviceIBM Jazz Reporting Service insufficient session expiration6.6 Medium
- linux, linux kernel +1 moreksmbd: fix incorrect validation for num_aces field of smb_acl7.6 High
- st x-cube-azrtos-wl, x-cube-azrt-h7rs, x-cube-azrtos-f4 +7 more +9 moreA buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of...8.5 High
- st x-cube-azrtos-f7, x-cube-azrtos-wl, x-cube-azrt-h7rs +7 more +9 moreA denial of service vulnerability exists in the NetX Component HTTP server functionality of...6.5 Medium
- st x-cube-azrtos-f7, x-cube-azrtos-wl, x-cube-azrt-h7rs +7 more +9 moreA denial of service vulnerability exists in the NetX Component HTTP server functionality of...6.5 Medium
- st x-cube-azrtos-f7, x-cube-azrtos-wl, x-cube-azrt-h7rs +7 more +9 moreAn integer underflow vulnerability exists in the HTTP server PUT request functionality of...4.3 Medium
- st x-cube-azrtos-f7, x-cube-azrtos-wl, x-cube-azrt-h7rs +7 more +9 moreAn integer underflow vulnerability exists in the HTTP server PUT request functionality of...4.3 Medium
- st x-cube-azrtos-f7, x-cube-azrtos-wl, x-cube-azrt-h7rs +7 more +9 moreAn integer underflow vulnerability exists in the HTTP server PUT request functionality of...4.3 Medium
- st x-cube-azrtos-f7, x-cube-azrtos-wl, x-cube-azrt-h7rs +7 more +9 moreAn integer underflow vulnerability exists in the HTTP server PUT request functionality of...4.3 Medium
- linux, linux kernel +1 moreiscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()7.1 High
- linux, linux kernel +1 moreHID: ignore non-functional sensor in HP 5MP Camera5.5 Medium
- linux, linux kernel +1 morex86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes7.8 High
- linux, linux kernel +1 moredrm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: fix missing .is_two_pixels_per_container5.5 Medium
- linux, linux kernel +1 morefs/netfs/read_collect: add to next->prev_donated9.8 Critical
- hachi crypt::saltCrypt::Salt for Perl uses insecure rand() function when generating salts for cryptographic purposes5.3 Medium
- linux, linux kernel +1 moredrm/amdgpu: init return value in amdgpu_ttm_clear_buffer5.5 Medium
- red hat openshift distributed tracing 3, openshift distributed tracing 3.5.3 +1 moreTempo-operator: tempo operator token exposition lead to read sensitive data4.3 Medium
- red hat openshift distributed tracing 3, openshift distributed tracing 3.5.3 +1 moreTempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator4.3 Medium
apparmorSUSESecurity update for apparmorNo score- paulgpetty wp time machinewp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- shopperapprovedapp shopper approved reviewsShopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- bobcares plugins gift certificate creatorGift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameter6.1 Medium
- romik84 demo awesomeDemo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation6.5 Medium
- etoilewebdesign front end usersFront End Users <= 3.2.32 - Authenticated (Admin+) SQL injection4.9 Medium
- dbejean advanced search by my solr serverAdvanced Search by My Solr Server <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- ulshamim video urlVideo Url <= 1.0.0.3 - Reflected Cross-Site Scripting6.1 Medium
- smartpixels smart icons for wordpressSmart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- etoilewebdesign front end usersFront-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload9.8 Critical
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- fortinet fortisiemA relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0...9.7 Critical
- open source robotics foundation robot operating system (ros), openrobotics robot operating system +1 moreUse of unsafe yaml load in dynparam7.8 High
- moxa edf-g1002-bp series, edr-8010 series, edr-810 series +5 more +7 moreCommend Injection Leading to Privilege Escalation8.6 High
- moxa edf-g1002-bp series, edr-8010 series, edr-810 series +5 more +7 moreCommand Injection in NTP Setting9.2 Critical
- zabbixDoS vulnerability due to uncontrolled resource exhaustion6.0 Medium
- zabbixReflected XSS vulnerability in /zabbix.php?action=export.valuemaps7.5 High
- zabbixExcessive information returned by user.get2.1 Low
- zabbixUser enumeration via timing attack in Zabbix web interface2.3 Low
- zabbixSQL injection in Zabbix API8.6 High
- hammock corporation assetview, assetview cloud +1 moreAssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent...5.9 Medium
- hammock corporation assetview, assetview cloud +1 moreMissing authentication for critical function vulnerability exists in AssetView and AssetView...8.2 High
- htplugins insert headers and footers code – ht scriptInsert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update6.5 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a...5.4 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote...5.4 Medium
- Show moreLoading…