CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- debian linux, linux kernel +1 moreksmbd: use aead_request_free to match aead_request_alloc5.5 Medium
- linux, linux kernel +1 moredmaengine: fsl-edma: free irq correctly in remove path7.8 High
- linux, linux kernel +1 moredrm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr5.5 Medium
- linux, linux kernel +1 moreremoteproc: core: Clear table_sz when rproc_shutdown5.5 Medium
- linux, linux kernel +1 moredrm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV4.7 Medium
- linux, linux kernel +1 morex86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors5.5 Medium
- linux, linux kernel +1 morejfs: reject on-disk inodes of an unsupported type5.5 Medium
- linux, linux kernel +1 moreLoongArch: BPF: Fix off-by-one error in build_prologue()7.8 High
- linux, linux kernel +1 moresfc: fix NULL dereferences in ef100_process_design_param()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreext4: fix OOB read when checking dotdot dir7.8 High
- mappresspro mappress, unknown mappress maps for wordpress +1 moreMapPress Maps for WordPress < 2.94.10 - Admin+ Stored XSS4.8 Medium
- yokogawa electric corporation cx1000 / cx2000 paperless recorders, dx1000 / dx2000 / dx1000n paperless recorders, dx1000t / dx2000t paperless recorders +5 more +7 moreInsecure default settings for recorder products9.8 Critical
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add-product.php unrestricted upload5.3 Medium
- elliotvs coupon affiliates – affiliate plugin for woocommerceCoupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter6.1 Medium
- pantherius modal surveyWordPress Modal Survey plugin <= 2.0.2.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- thimpress ivy schoolWordPress Ivy School theme <= 1.6.0 - Local File Inclusion Vulnerability8.1 High
- pantherius modal surveyWordPress Modal Survey plugin <= 2.0.2.0.1 - SQL Injection vulnerability9.3 Critical
- qualitia active! mail, qualitia co., ltd. active! mail 6, qualitia active\! mail +2 moreActive! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow...9.8 Critical
- mehrazmorshed login manager – design login page, view login activity, limit login attemptsLogin Manager – Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL4.4 Medium
- piotnetdotcom piotnet addons for elementorPiotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wonderboymusic avatarAvatar <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - rgxfw_hwperf_get_packet_buffer OOB write8.2 High
- tp-link systems inc. tl-wr841n v14/v14.6/v14.8, tp-link wr841n firmware +1 moreXSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp page8.6 High
- freedesktop popplerNSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures...4.3 Medium
- astrologA buffer overflow vulnerability in Astrolog v7.70 allows attackers to execute arbitrary code or...7.8 High
- nodebbCross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to...6.1 Medium
- nodebbCross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to...6.1 Medium
- totolink x18 firmwareTOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the...9.8 Critical
- qimou cms project cmsAn issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade...9.8 Critical
- personal-management-system personal management systemVolmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF)...4.7 Medium
- No product listedImproper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows...9.8 Critical
- No product listedImproper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10...9.8 Critical
- No product listedAn issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers...8.8 High
- No product listedNautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code...9.8 Critical
- No product listedAn information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui...7.5 High
- No product listedIncorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000,...9.1 Critical
- jmbroadcast jmb0150 firmwareIncorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows...9.1 Critical
- No product listedIncorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to...9.1 Critical
- jmbroadcast jmb0150 firmwareIncorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access...9.1 Critical
- orban optimod 5950 firmwareIncorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows...9.8 Critical
- electrolink fm\/dab\/tv transmitter web management systemA credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01...7.5 High
- kidocode crawl4aiCrawl4AI SSRF vulnerability9.1 Critical
- nagios network analyzerAn access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to...7.5 High
- macro-video v380e6 c1 firmwareAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302...2.6 Low
- macro-video v380e6 c1 firmwareAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302...6.8 Medium
- macro-video v380 proAn issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro...3.4 Low
- redox-os redoxAn issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of...5.5 Medium
- secloreAn issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a...9.8 Critical
- 74cms74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.6.3 Medium
- alkacon opencmsAlkacon OpenCMS stored cross-site scripting (XSS) vulnerability5.4 Medium
- Show moreLoading…