CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- dlink dir-823x firmwareAn issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the...9.8 Critical
- dlink dir-823x firmwareAn issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the...9.8 Critical
- dlink dir-823x firmwareAn issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the...9.8 Critical
- dlink dir-823x firmwareAn issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the...7.2 High
- codeastro internet banking systemCode Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name...6.1 Medium
- dogukanurker flaskblogAn arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1...6.5 Medium
- appventure dietiqaA SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php...9.8 Critical
- dragonflydb dragonflyDragonflyDB Dragonfly through 1.28.2 allows authenticated users to cause a denial of service ...3.3 Low
- dragonflydb dragonflyDragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service ...3.3 Low
- tenda ac10 firmwareTenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via cloneType2.7.5 High
- tenda ac10 firmwareTenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2.7.5 High
- tenda ac10 firmwareTenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2.7.5 High
- hazelcast management centerHazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user...9.8 Critical
- open-metadata openmetadataOpenMetadata SQL Injection7.1 High
- think tk-rt-wr135g firmwareAn issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a...8.4 High
- dgorissen pycelPycel allows code injection via a crafted formula9.8 Critical
- pydioPydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.5.4 Medium
- google chromeos, chrome os +1 moreOut-of-Bounds Read in ip_set_bitmap_ip.c in Google ChromeOS Kernel Versions 6.1, 5.15, 5.10, 5.4,...8.8 High
- google chromeos, chrome os +1 moreComponentInstaller Modification in ComponentInstaller in Google ChromeOS 124.0.6367.34 on...6.5 Medium
- google chromeos, chrome os +1 moreAccess Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 131.0...8.8 High
- google chromeos, chrome os +1 moreDNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 129.0.6668.36 allows...7.5 High
- hitachi vantara pentaho data integration & analyticsHitachi Vantara Pentaho Data Integration & Analytics – Path Traversal6.8 Medium
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference4.9 Medium
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference4.9 Medium
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4.4 Medium
- hitachi vantara pentaho data integration & analyticsHitachi Vantara Pentaho Data Integration & Analytics – Path Traversal6.8 Medium
- hitachi vantara pentaho data integration & analyticsHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')9.1 Critical
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4.4 Medium
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource6.1 Medium
- espocrmEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function3.1 Low
- softethervpnSoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA3.1 Low
- omnissa horizon client for windowsOmnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local...7.8 High
- zulip, zulip server +1 moreZulip Authentication Backend Configuration Bypass8.2 High
- linuxfoundation pytorchPyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service4.8 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System Database Backup backup.php os command injection6.9 Medium
- google chromeUse after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to...8.8 High
- google chromeHeap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a...8.8 High
- razormist simple hotel booking systemSourceCodester Simple Hotel Booking System login buffer overflow4.8 Medium
- pcman ftp serverPCMan FTP Server STATUS Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server CD Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server MIC Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server DIR Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server MDTM Command buffer overflow6.9 Medium
- sonicwall connect tunnelA Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and...6.1 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 18.4.1,...9.8 Critical
- apple ipados, macos, tvos +5 more +7 moreA memory corruption issue was addressed with improved bounds checking. This issue is fixed in...9.8 Critical
- pgbouncer, debian linux +1 morePgBouncer default auth_query does not take Postgres password expiry into account8.1 High
- siemens telecontrol server basicA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The...8.7 High
- siemens telecontrol server basicA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The...8.7 High
- siemens telecontrol server basicA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The...8.7 High
- Show moreLoading…