CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
silverstripe/frameworkPackagistSilverstripe Framework user enumeration via timing attack on login and password reset forms5.3 Medium- oisf suricataSuricata datasets: ruleset declared settings can lead to resource starvation6.2 Medium
- oisf suricataSuricata af-packet: defrag option can lead to truncated packets affecting visibility7.5 High
nssTuxCare,nsprTuxCare,nspr-develTuxCare +10 more +12 moreUpdate of nssNo score- sonicwall netextenderAn Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall...7.2 High
- sonicwall netextenderA local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit)...7.2 High
- sonicwall netextenderAn improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64...7.2 High
nettleTuxCare,nettle-develTuxCare +1 moreUpdate of nettleNo score- wikimedia foundation mediawikiAbuseFilter log interfaces expose global private and hidden filters when central DB is not available2.3 Low
- wikimedia foundation mediawiki, parsoid +1 morePotential javascript injection attack enabled by Unicode normalization in Action API2.1 Low
- wikimedia foundation mediawikiLogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions2.1 Low
- wikimedia foundation mediawikiCascading protection is not preventing file reversions0.0 None
- wikimedia foundation mediawiki"reupload-own" restriction can be bypassed by reverting file0.0 None
- wikimedia foundation mediawikii18n XSS vulnerability in HTMLMultiSelectField when sections are used0.0 None
- spring cloud configSpring Cloud Config Server May Not Use Vault Token Sent By Clients5.3 Medium
nettleTuxCare,nettle-develTuxCare +1 moreUpdate of nettleNo score- mattermost, mattermost server +1 moreUnauthorized Access to User Activity Logs API by delegated granular administration roles2.7 Low
- metabaseSnowflake credentials logged by the Metabase backend1.8 Low
- yiiframework yiiYii does not prevent XSS in scenarios where fallback error renderer is used6.1 Medium
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab6.4 Medium
- gitlabDebug Messages Revealing Unnecessary Information in GitLab3.7 Low
- ibm sterling control centerIBM Sterling Control Center information disclosure4.0 Medium
- vitejs viteVite has an `server.fs.deny` bypass with an invalid `request-target`6.0 Medium
- ibm sterling control centerIBM Sterling Control Center cross-site scripting5.4 Medium
nssTuxCare,nsprTuxCare,nspr-develTuxCare +10 more +12 moreUpdate of nssNo score- ibm maximo application suiteIBM Maximo Application Suite improper access control6.5 Medium
- hedgedocHedgeDoc allows XSS possibility through malicious SVG uploads6.4 Medium
- 1panel-dev maxkbMaxKB has a reverse shell vulnerability in function library4.3 Medium
- gitlabGeneration of Error Message Containing Sensitive Information in GitLab6.3 Medium
- silverstripe framework, silverstripe-framework +1 moreSilverstripe Framework has a XSS vulnerability in HTML editor5.4 Medium
- silverstripe silverstripe-elementalSilverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports5.4 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabInsufficient Granularity of Access Control in GitLab5.3 Medium
ibexa/fieldtype-richtextPackagistibexa/fieldtype-richtext allows access to external entities in XML7.1 Highezsystems/ezplatform-richtextPackagistezsystems/ezplatform-richtext allows access to external entities in XML7.1 High- jenkins ssh-slave, jenkins project jenkins/ssh-slave docker images +1 moreIn jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation...9.1 Critical
- jenkins ssh-agent, jenkins project jenkins/ssh-agent docker images +1 moreIn jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image...9.1 Critical
- panasonic ir control hub (ir blaster)Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with...7.5 High
- videx inc. cyberaudit-webSSRF in CyberAudit-Web videx-legacy-ssl6.0 Medium
- videx inc. cyberaudit-webAuthentication Bypass in CyberAudit-Web9.3 Critical
- hugh mungus vice versaWordPress Vice Versa plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- aribhour linet erp-woocommerce integrationWordPress Linet ERP-Woocommerce Integration plugin <= 3.5.12 - Arbitrary File Read/Deletion vulnerability5.9 Medium
- crocoblock jetcomparewishlistWordPress JetCompareWishlist plugin <= 1.5.9 - Local File Inclusion vulnerability7.5 High
- hewlett packard enterprise hpe nonstop osm service connection suiteHPE NonStop OSM Service Connection Suite, Denial of Service vulnerability6.8 Medium
- sharethis dashboard for google analyticsWordPress ShareThis Dashboard for Google Analytics plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ays pro survey makerWordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerability4.3 Medium
- detheme dethemekit for elementorWordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerability5.3 Medium
- alimir wp ulikeWordPress WP ULike plugin <= 4.7.9.1 - Content Spoofing Vulnerability5.3 Medium
- quantumcloud seo helpWordPress SEO Help plugin <= 6.7.9 - Broken Access Control vulnerability6.5 Medium
- toast plugins internal link optimiserWordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerability6.5 Medium
- Show moreLoading…