CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- joomla joomla\!, joomla! project cms +1 more[20250402] - Joomla Core - MFA Authentication Bypass7.5 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) hpe aruba networking aos +1 moreAuthenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write7.2 High
- zoom communications, inc workplace apps for windows, zoom meeting software development kit, rooms +3 more +5 moreZoom Workplace Apps for Windows - Null Pointer6.5 Medium
- zoom communications, inc workplace apps for windows, zoom meeting software development kit, rooms +3 more +5 moreZoom Workplace Apps for Windows - Null Pointer6.5 Medium
- zoom communications, inc workplace apps for windows, zoom meeting software development kit, rooms +2 more +4 moreZoom Workplace Apps for Windows - Insecure Default Variable Initialization2.8 Low
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - Cross Site Scripting4.6 Medium
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - Cross Site Scripting4.6 Medium
- haxtheweb issues, psu haxcms-php +1 moreHAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution10.0 Critical
- hewlett packard enterprise (hpe) aos-10 apArbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI Interface6.0 Medium
- hewlett packard enterprise (hpe) aos-10 apAuthenticated Remote Command Execution caused by Insecure Function Usage in System Binary6.5 Medium
- cursorArbitrary file write from Cursor Agent through a prompt injection from malicious @Docs8.1 High
- umbraco umbraco-cms, cms +1 moreUmbraco has a Management API Vulnerability to Path Traversal With Authenticated Users8.8 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- element-hq element-webElement Web could load a malicious instance of Element Call leaking media encryption keys3.8 Low
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- rockwell automation arena®, rockwellautomation arena +1 moreLocal Code Execution Vulnerability in Arena®8.5 High
- bep imagemetabep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing6.9 Medium
- ibm personal communicationsIBM Personal Communications command execution8.8 High
- bep imagemetabep/imagemeta allows excessively large EXIF data structures6.9 Medium
- guichaguri crud-query-parserImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser9.3 Critical
- ivanti endpoint managerReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7...8.2 High
- ivanti endpoint managerReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7...6.1 Medium
- ivanti endpoint managerAn untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1...6.1 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7...7.2 High
- ivanti endpoint managerImproper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before...4.8 Medium
- ivanti endpoint managerDLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7...7.8 High
- fortinet fortianalyzer, fortimanager, fortios +3 more +5 moreA improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in...3.0 Low
- fortinet fortianalyzer, fortimanager, fortios +3 more +5 moreA improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in...7.1 High
- fortinet fortios, fortiproxy +1 moreMultiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration ...6.7 Medium
- fortinet fortianalyzer, fortimanager +1 moreAn Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1...5.0 Medium
- fortinet fortiwebAn Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version...5.6 Medium
- fortinet fortios, siemens ruggedcom ape1808 +1 moreA storing passwords in a recoverable format in Fortinet FortiOS versions 7.2.0 through 7.2.1...2.1 Low
- fortinet fortiisolatorAn improper neutralization of special elements used in an OS command ('OS Command Injection')...6.5 Medium
- fortinet fortiisolatorAn improper neutralization of special elements used in an OS command ('OS Command Injection')...7.0 High
- fortinet fortiwebAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ...6.8 Medium
- fortinet forticlientemsAn improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79]...2.6 Low
- c-aresc-ares has a use-after-free in read_answers()8.3 High
- shopwareShopware 6 allows attackers to check for registered accounts through the store-api5.5 Medium
- shopwareShopware allows Denial Of Service via password length7.5 High
- red hat directory server 11, directory server 12, enterprise linux 10 +8 more +10 moreCrossbeam-channel: crossbeam-channel vulnerable to double free on drop6.5 Medium
- melapress login security, login security premium +1 moreMelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion5.3 Medium
- themehunk vayu blocks – gutenberg blocks for wordpress & woocommerceVayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update5.3 Medium
- Show moreLoading…