CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- phpgurukul men salon management systemPHPGurukul Men Salon Management System contact-us.php sql injection5.3 Medium
- udo-munk z80packz80pack Vulnerable to Exposure of the GITHUB_TOKEN in Workflow Run Artifact8.7 High
youtube-dlPyPIyoutube-dl vulnerable to file system modification and RCE through improper file-extension sanitization7.8 High- daicuoDaiCuo SEO Optimization Settings Section cross site scripting4.8 Medium
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik affected by Go HTTP Request Smuggling Vulnerability9.1 Critical- tenable nessusLog Poisoning in Nessus4.3 Medium
- tenable nessusLocal Priviledge Escalation7.8 High
- hp touchpoint analytics service, hp, inc. hp touchpoint analytics service +1 moreHP Touchpoint Analytics Service – Potential Escalation of Privilege6.9 Medium
- langgenius difyDify Allows Unauthorized APP Enable/Disable via API6.5 Medium
- langgenius difyDify Allows Insecure User Role Access Control for APP Editing6.5 Medium
- namelessmc namelessNamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages8.6 High
- namelessmc namelessNamelessMC Vulnerable to Cookie-Based View Count Manipulation5.3 Medium
- namelessmc namelessNamelessMC Has Forum Reply Submission Time Limit Bypass7.1 High
- namelessmc namelessNamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion7.3 High
- namelessmc namelessNamelessMC Forum iframe width/height abuse causing UI-based Denial of Service7.1 High
- namelessmc namelessNamelessMC Has Lack of Length Validation for s Parameter in GET Requests7.5 High
- element-hq element-x-androidElement X Android vulnerable to loading malicious web pages via received intent6.5 Medium
- apache activemq nms openwire, apache software foundation activemq nms openwire client +1 moreApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass9.8 Critical
- linuxfoundation pytorchPyTorch: `torch.load` with `weights_only=True` leads to remote code execution9.3 Critical
- endojs endoses's global contour bindings leak into Compartment lexical scope8.7 High
- @clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 more +3 morefastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header7.5 High
- @clerk fastifyFastify vulnerable to invalid content-type parsing, which could lead to validation bypass7.5 High
- seacmsSeaCMS admin_link.php sql injection5.1 Medium
- ibm iIBM i improper HTTP header neutralization5.4 Medium
- symisc unqlitesymisc UnQLite unqlite.c jx9MemObjStore heap-based overflow4.8 Medium
- linux, linux kernel +1 moreHSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition7.8 High
- linux, linux kernel +1 moreio_uring: fix io_req_prep_async with provided buffers7.8 High
- baseweb jsitebaseweb JSite Apache Druid Monitoring Console index.html access control6.9 Medium
- baseweb jsitebaseweb JSite save cross site scripting5.1 Medium
- langgenius difyDify Allows Insecure User Role Access Control for APP DSL Exporting6.3 Medium
- ibm sterling connect:direct web services, sterling connect direct web services +1 moreIBM Sterling Connect:Direct Web Services session fixation6.3 Medium
- ibm sterling connect:direct web services, sterling connect direct web services +1 moreIBM Sterling Connect:Direct Web Services improper authorization6.3 Medium
- baseweb jsitebaseweb JSite save cross site scripting5.1 Medium
- pbootcmsPbootCMS Image server-side request forgery5.1 Medium
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget6.4 Medium
- tenda ac15, ac15 firmware +1 moreTenda AC15 WifiExtraSet fromSetWirelessRepeat buffer overflow8.7 High
- asus routerAn improper authentication control vulnerability exists in AiCloud. This vulnerability can be...9.2 Critical
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflow8.7 High
- codename065 download managerDownload Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload5.4 Medium
- linux, linux kernel +1 moremd/raid10: wait barrier before returning discard request with REQ_NOWAIT5.5 Medium
- linux, linux kernel +1 moreiio: light: Add check for array bounds in veml6075_read_int_time_ms7.8 High
- linux, linux kernel +1 moreobjtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()7.8 High
- linux, linux kernel +1 morex86/mce: use is_copy_from_user() to determine copy-from-user context5.5 Medium
- linux, linux kernel +1 moreASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()8.4 High
- linux, linux kernel +1 moreobjtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()7.1 High
- linux, linux kernel +1 morestaging: gpib: Fix cb7210 pcmcia Oops5.5 Medium
- linux, linux kernel +1 morejfs: fix slab-out-of-bounds read in ea_get()7.1 High
- linux, linux kernel +1 moreclk: samsung: Fix UBSAN panic in samsung_clk_init()5.5 Medium
- linux, linux kernel +1 morenfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()7.5 High
- debian linux, linux kernel +1 morenet_sched: skbprio: Remove overly strict queue assertions5.5 Medium
- Show moreLoading…