CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- mra13 simple shopping cartWordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter8.2 High
- trellix fireeye edr hxA malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR...6.5 Medium
- axis camera station proGee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible...5.9 Medium
- axis camera station proGee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a...6.1 Medium
- synology diskstation manager (dsm), diskstation manager +1 moreMissing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1...7.5 High
vllmPyPICVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.09.8 Critical- busybox, siemens ruggedcom rst2428p +1 moreIn tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through...3.2 Low
- imagemagickIn multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...2.9 Low
- tenda ac9 firmwareIn the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow...9.8 Critical
- tenda ac9 firmwareIn Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform...9.8 Critical
- tenda ac9 firmwareIn Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform...9.8 Critical
- imagemagick, debian linux +1 moreIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after...2.9 Low
- ivanti landesk management suiteA directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9....5.8 Medium
- No product listedA Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations...6.1 Medium
- No product listedBYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to...8.1 High
- totolink a3000ru firmware, a3100r firmware, a830r firmware +1 more +3 moreTOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c...7.3 High
- totolink a3000ru firmware, a3100r firmware, a830r firmware +1 more +3 moreTOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c...7.3 High
- totolink a810r firmwareTOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in...7.3 High
- totolink a810r firmwareTOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in...7.3 High
- totolink a800r firmwareTOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in...7.3 High
- totolink a800r firmwareTOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in...7.3 High
- totolink a800r firmwareTOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in...7.3 High
- totolink a800r firmwareTOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via...6.5 Medium
- nih bricsNIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users...4.3 Medium
- nih bricsNIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates...7.5 High
- busyboxIn netstat in BusyBox through 1.37.0, local users can launch of network application with an argv...2.5 Low
- hewlett packard enterprise (hpe) hpe cray data virtualization service (dvs)A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS)....6.8 Medium
- hewlett packard enterprise (hpe) hpe cray operating system (cos)A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to...5.5 Medium
- hewlett packard enterprise hpe performance cluster manager (hpcm)A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an...9.8 Critical
- xrplf xrpl.jsCompromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.29.3 Critical
- nvidia appNVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an...2.5 Low
- sap se s/4 hana (learning solution)Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)4.6 Medium
- sap se field logisticsOData meta-data property entity tampering in SAP Field Logistics4.3 Medium
- miraheze managewikiManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions4.6 Medium
- cuba-platform jpawebapiCUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint6.4 Medium
- cuba-platform restapiCUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files Endpoint6.4 Medium
- cuba-platform cubaCUBA Vulnerable to Denial of Service (DoS) in the File Storage6.5 Medium
- jmix-framework jmix, haulmont cuba platform, cuba rest api +2 more +4 moreio.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage6.5 Medium
- jmix-framework jmix, haulmont cuba platform, cuba rest api +2 more +4 moreio.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API6.4 Medium
- jmix-framework jmix, haulmont jmix framework +1 moreio.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage6.5 Medium
- octoprintOctoPrint Authenticated Reverse Proxy Page Authentication Bypass4.3 Medium
- commvault command center, command center innovation release, commvault +2 moreCommvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal9.3 Critical
- ibm websphere application serverIBM WebSphere Application Server server-side request forgery4.1 Medium
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of...7.6 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper...7.6 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of...7.6 High
- centreon bamSQL Injection in Centreon BAM boolean KPI listing7.2 High
- ibm hardware management console - power systems, hardware management console +1 moreIBM Hardware Management Console - Power Systems command execution8.4 High
- ibm hardware management console - power systems, hardware management console +1 moreIBM Hardware Management Console - Power Systems command execution9.3 Critical
- tecnick tcexamTecnick – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')8.8 High
- Show moreLoading…