CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- youdiancmsYouDianCMS index.html cross site scripting5.3 Medium
- perlPerl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes8.4 High
- lds crypt::cbcCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions4.0 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cm-wp clearfy, creativemotion clearfy cache – wordpress optimization plugin, minify html, css & js, defer +1 moreWebcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache5.3 Medium
- sktthemes skt blocks, sonalsinha21 skt blocks – gutenberg based page builder +1 moreSKT Blocks – Gutenberg based Page Builder <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cm-wp clearfy, creativemotion clearfy cache – wordpress optimization plugin, minify html, css & js, defer +1 moreWebcraftic Clearfy – WordPress optimization plugin <= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy'4.3 Medium
- wpclever wpc admin columnsWPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update8.8 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder, user registration \& membership +1 moreUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification5.3 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder, user registration \& membership +1 moreUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update4.3 Medium
CefSharp.OffScreenNuGet,CefSharp.OffScreen.NetCoreNuGet,CefSharp.WinFormsNuGet +4 more +6 moreCefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows8.3 High- jupyterhub jupyter-remote-desktop-proxyJupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended9.0 Critical
- quadlayers quadmenu – mega menuWordPress Mega Menu – QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update4.3 Medium
- bap22 developer toolbarDeveloper Toolbar <= 1.0.3 - Unauthenticated Information Exposure5.3 Medium
- reality66 cart66 cloud :: wordpress ecommerce the easy wayCart66 Cloud <= 2.3.7 - Unauthenticated Information Exposure5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability7.5 High
- microsoft visual studio codeVisual Studio Code Elevation of Privilege Vulnerability6.8 Medium
- microsoft sql server management studio, sql server management studio 20.2, visual studio tools for applications (vsta) +6 more +8 moreVisual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability7.3 High
- 10web photo gallery by 10web – mobile-friendly image galleryPhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter6.1 Medium
- palo alto networks prisma access browserPrisma Access Browser: Inappropriate control behavior in Prisma Access Browser9.3 Critical
- lenovo system x3550 m5, system x3560 m5 +1 moreAn input validation weakness was reported in the TpmSetup module for some legacy System x server...6.7 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures5.9 Medium
- palo alto networks cortex xdr broker vmCortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM6.3 Medium
kernelTuxCare,bpftoolTuxCare,kernel-abi-stablelistsTuxCare +30 more +32 moreUpdate of kernelNo score- the wikimedia foundation mediawiki - extension:simplecalendarXSSes in Extension:SimpleCalendar6.9 Medium
- the wikimedia foundation mediawiki - version compare extensionXSSes and potential RCE in Special:VersionCompare6.9 Medium
- the wikimedia foundation mediawiki - growthexperimentsSaving the right content to MediaWiki:GrowthMentors.json can take down the site6.5 Medium
- the wikimedia foundation mediawiki - mobile frontend extensionCross-origin data leak in mobilefrontend via lazy load images6.9 Medium
- the wikimedia foundation mediawiki - visual data extensionEvil regex used to process user-provided data in VisualData6.9 Medium
- the wikimedia foundation mediawiki core - feed utilsHTML injection in feed output from i18n message6.9 Medium
- the wikimedia foundation mediawiki - html tagsSystem message XSS in HTMLTags5.4 Medium
- the wikimedia foundation mediawiki - confirm account extensionXSSes in Extension:ConfirmAccount5.4 Medium
- the wikimedia foundation mediawiki - tabs extensionIP and user agent leaks in Extension:Tabs6.9 Medium
- the wikimedia foundation mediawiki - growth experiments extensioni18n XSS vulnerability in message growthexperiments5.4 Medium
- the wikimedia foundation mediawiki - oauth extensionRevoking authorization of OAuth2 consumer does not invalidate refresh tokens5.4 Medium
- the wikimedia foundation mediawiki - wikibase media info extensionWikitext stored XSS on filepages due to dangerous WBMI serialization5.4 Medium
- the wikimedia foundation mediawiki - ajax poll extensionXSSes in AJAXPoll5.4 Medium
- the wikimedia foundation mediawiki - wikidata extensionWikibase CommonsInlineImageFormatter: i18n XSS5.4 Medium
- subnet solutions powersystem center 2020Subnet Solutions PowerSYSTEM Center Deserialization of Untrusted Data6.9 Medium
- subnet solutions powersystem center 2020Subnet Solutions PowerSYSTEM Center Out-of-Bounds Read5.3 Medium
- apple macosProcessing a file may lead to a denial-of-service or potentially disclose memory contents. This...6.4 Medium
- apple macos, ios and ipados, ipad os +1 more +3 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and...7.8 High
- apple macosProcessing a file may lead to a denial-of-service or potentially disclose memory contents. This...6.4 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and...6.3 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and...4.3 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS...3.3 Low
- apple macosAn app may be able to elevate privileges. This issue is fixed in macOS 14. This issue was...7.3 High
- apple macosProcessing a file may lead to a denial-of-service or potentially disclose memory contents. This...5.4 Medium
- apple ipados, ios and ipados, iphone os +2 morePrivate Browsing tabs may be accessed without authentication. This issue is fixed in iOS 17 and...4.0 Medium
- Show moreLoading…