CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- os4ed opensisAn issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by...9.8 Critical
- go standard library net/http/internal, siemens sentron 7kt pac1261 data manager +1 moreRequest smuggling due to acceptance of invalid chunked data in net/http9.1 Critical
- snowplow stream collectorThis vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a...7.5 High
- snowplow iglu serverAn issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but...6.5 Medium
- snowplow snowbridgeAn issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It...7.5 High
- snowplow iglu serverAn issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but...7.5 High
- snowplow enrichAn issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously...7.5 High
- snowplow iglu serverAn issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads...7.5 High
- No product listedinsightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can...8.8 High
- No product listedinsightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. Attackers can inject...8.8 High
- open-emr openemrOpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, ...9.8 Critical
gslopenSUSEgsl-2.8-4.1 on GA mediaNo score- wondercmsWonderCMS Theme Installation/Plugin Installation installUpdateModuleAction unrestricted upload5.1 Medium
- xpdfOut-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.052.1 Low
- hcl software devops deploy / hcl launch, hcltechsw hcl devops deploy, hcl launch +2 moreHCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other services6.3 Medium
- webassembly wabt, binary toolkit +1 moreWebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference2.3 Low
- linuxfoundation pytorchPyTorch torch.jit.jit_module_from_flatbuffer memory corruption4.8 Medium
- conda-forge infrastructureconda-forge infrastructure uses a bad token for Azure's cf-staging access9.3 Critical
- phpgurukul apartment visitors management systemSourceCodester Apartment Visitors Management System add-apartment.php sql injection5.3 Medium
- oretnom23 online tutor portalSourceCodester Online Tutor Portal manage_course.php sql injection5.3 Medium
- vercel next.jsNext.js may leak x-middleware-subrequest-id to external hosts1.7 Low
- tauri plugin-shell, tauri-apps plugins-workspace +1 moreImproper Scope Validation in the open Endpoint of tauri-plugin-shell9.3 Critical
- canonical get-workflow-version-actioncanonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output8.2 High
- arduino arduino-ideSelf Cross-Site Scripting in Arduino IDE1.0 Low
- oretnom23 online tutor portalSourceCodester Online Tutor Portal view_course.php sql injection5.3 Medium
- drupal obfuscateObfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0295.4 Medium
- access code project code, drupal access code +1 moreAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-0284.8 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs, tacjs project tacjs +2 moretarteaucitron.js allows url scheme injection via unfiltered inputs4.8 Medium
- trend micro, inc. vision one, trendmicro trend vision one +1 moreAn HTML injection vulnerability previously discovered in Trend Vision One could have allowed a...4.6 Medium
- trend micro, inc. vision one, trendmicro trend vision one +1 moreA broken access control vulnerability previously discovered in the Trend Vision One Role Name...4.6 Medium
- trend micro, inc. vision one, trendmicro trend vision one +1 moreA broken access control vulnerability previously discovered in the Trend Vision One Status...4.6 Medium
- trend micro, inc. vision one, trendmicro trend vision one +1 moreA broken access control vulnerability previously discovered in the Trend Vision One User Roles...4.6 Medium
- trend micro, inc. vision one, trendmicro trend vision one +1 moreA broken access control vulnerability previously discovered in the Trend Vision One User Account...4.6 Medium
- amd ryzen™ ai softwareInteger overflow within the AMD NPU Driver could allow a local attacker to write out of bounds,...7.9 High
- amd ryzen™ ai softwareInteger overflow within AMD NPU Driver could allow a local attacker to write out of bounds,...7.3 High
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreA vulnerability in the web-based management interface of Cisco Evolved Programmable Network...4.8 Medium
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreA vulnerability in the web-based management interface of Cisco Evolved Programmable Network...6.1 Medium
- amd ryzen™ ai softwareInteger overflow within AMD NPU Driver could allow a local attacker to write out of bounds,...7.9 High
- cisco enterprise chat and emailA vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow...7.5 High
- cisco meraki mx firmwareA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series...7.7 High
- amd ryzen™ ai softwareIncorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker...7.3 High
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms information disclosure5.3 Medium
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms cross-site scripting5.4 Medium
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms cross-site request forgery4.3 Medium
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms information disclosure5.3 Medium
- ibm content navigatorIBM Content Navigator cross-site scripting5.4 Medium
- image-size, red hat gatekeeper 3, build of podman desktop +15 more +17 moreimage-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser8.7 High
- jenkins asakusasatellite, jenkins project asakusasatellite plugin +1 moreJenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form5.5 Medium
- jenkins asakusasatellite, jenkins project asakusasatellite plugin +1 moreJenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files5.5 Medium
- jenkins stack hammer, jenkins project stack hammer plugin +1 moreJenkins Stack Hammer Plugin Stores API Keys Unencrypted in Job `config.xml` Files5.5 Medium
- Show moreLoading…