CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- labsai eddilabsai/eddi Vulnerable to Path Traversal (Zip Slip) in ZIP Import Function6.5 Medium
- openrazerOpenRazer Vulnerable to Out of Bounds Read5.5 Medium
- microsoft power automate for desktopMicrosoft Power Automate Desktop Information Disclosure Vulnerability5.7 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreLibsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value9.0 Critical
- perforce helix almPotential Username Enumeration in Helix ALM6.3 Medium
- netskope clientSymlink Following in Netskope Client Postinstall Script5.2 Medium
- mozilla thunderbirdUser Interface (UI) Misrepresentation of attachment URL6.4 Medium
- mozilla thunderbirdLeak of hashed Window credentials via crafted attachment URL6.3 Medium
- mozilla thunderbirdInformation Disclosure of /tmp directory listing6.3 Medium
- framasoft peertubePeerTube User Import Authenticated Resource Exhaustion6.5 Medium
- framasoft peertubePeerTube ActivityPub Playlist Creation Blind SSRF and DoS7.5 High
aws-cdk-libnpmaws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role2.2 Low- framasoft peertubePeerTube ActivityPub Crawl Infinite Loop DoS7.5 High
- weblateWeblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext2.2 Low
- donknap dpanelDpanel's hard-coded JWT secret leads to remote code execution9.8 Critical
- framasoft peertubePeerTube Arbitrary Playlist Creation via ActivityPub Protocol5.3 Medium
- mozilla firefoxRace condition in nsHttpTransaction could lead to memory corruption6.5 Medium
- framasoft peertubePeerTube Arbitrary Playlist Creation via REST API4.3 Medium
- framasoft peertubePeerTube User Import Authenticated Persistent Denial of Service6.5 Medium
- reichertbrothers simplyrets real estate idxWordPress SimplyRETS Real Estate IDX plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- kagla gnucommerceWordPress GNUCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability9.8 Critical
- notfound wpjobboardWordPress WPJobBoard plugin < 5.11.1 - Multiple Cross Site Request Forgery (CSRF) vulnerabilities vulnerability4.3 Medium
- themegoods photographyWordPress Photography theme < 7.7.6 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- fs-code fs posterWordPress FS Poster plugin <= 6.5.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- royal-elementor-addons royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- eric-oliver mächler dsgvo youtubeWordPress DSGVO Youtube plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- quý lê 91 administrator zWordPress Administrator Z <= 2025.03.24 - Privilege Escalation Vulnerability8.8 High
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability7.5 High
- vowelweb industrial liteWordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability4.3 Medium
- 1pluginjquery zooeffectWordPress ZooEffect plugin <= 1.11 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetpopupWordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability7.5 High
- crocoblock jettricksWordPress JetTricks plugin <= 1.5.1 - Broken Access Control Vulnerability7.5 High
- mobeen abdullah coming soon, maintenance modeWordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerability7.5 High
- hockeydata los, notfound hockeydata los +1 moreWordPress hockeydata LOS plugin <= 1.2.4 - Local File Inclusion vulnerability7.5 High
- rstheme rs elements elementor addonWordPress RS Elements Elementor Addon plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tc.k advance wp query search filterWordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- aweos gmbh email notifications for updatesWordPress Email Notifications for Updates <= 1.1.6 - Privilege Escalation Vulnerability8.8 High
- dmitry v. (ceo of "ukr solution") barcode generator for woocommerceWordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Arbitrary Content Deletion vulnerability7.5 High
- fatcatapps landing page catWordPress Landing Page Cat plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- framasoft peertubePeerTube HLS Video Files Path Traversal3.7 Low
- milestone systems xprotect vmsSystem configuration password reset5.5 Medium
- binsaifullah awesome logo carousel blockLogo Carousel Gutenberg Block <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter6.4 Medium
- t-innova deporsiteInsecure Direct Object Reference en Deporsite de T-INNOVA8.7 High
- t-innova deporsiteInsecure Direct Object Reference on Deporsite by T-INNOVA8.7 High
- aidexCode Injection Vulnerability in AiDex9.3 Critical
- aidexAdversarial Input Handling Vulnerability in AiDex9.3 Critical
- solarwinds serv-uSolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability2.6 Low
- analytify simple social media share buttons, wpbrigade simple social buttons +1 moreSimple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSS4.8 Medium
- Show moreLoading…