CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- fig2dev project fig2dev, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreXfig: fig2dev stack-overflow via read_objects5.5 Medium
- fig2dev project fig2dev, red hat enterprise linux 6, enterprise linux 7 +5 more +7 moreXfig: xfig: stack-overflow allows possible code execution via local input manipulation7.8 High
- sonicwall sonicosA Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a...7.5 High
- drunkenmonkey search api solrSearch API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-0464.3 Medium
- drupal sportsleagueSportsleague - Critical - Unsupported - SA-CONTRIB-2025-0457.3 High
- drupal ueditor - 百度编辑器, ueditor project ueditor +1 moreUEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-0447.3 High
- drupal block classBlock Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0436.1 Medium
- bootstrap site alert project site alert, drupal bootstrap site alert +1 moreBootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0426.1 Medium
- colorbox project colorboxColorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0416.1 Medium
- bec technologies multiple routers, bectechnologies router firmware +1 moreBEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability7.2 High
- bec technologies multiple routers, bectechnologies router firmware +1 moreBEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability5.3 Medium
- bec technologies multiple routers, bectechnologies router firmware +1 moreBEC Technologies Multiple Routers Authentication Bypass Vulnerability5.3 Medium
- bec technologies multiple routers, bectechnologies router firmware +1 moreBEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability4.9 Medium
- bdrive netdriveBdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.8 High
- bdrive netdriveBdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.8 High
- arista ng firewallArista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability8.8 High
- carlinkit cpc200-ccpa, autokit +1 moreCarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability7.6 High
- carlinkit cpc200-ccpa, autokit +1 moreCarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability8.0 High
- carlinkit cpc200-ccpa, autokit +1 moreCarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability6.8 Medium
- carlinkit cpc200-ccpa, autokit +1 moreCarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability7.8 High
- gimpGIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- gimpGIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability7.8 High
- posthogPostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability7.1 High
- posthogPostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability7.1 High
- posthogPostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability7.1 High
- sonos era 300, s2 +1 moreSonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability8.8 High
- sonos era 300, s1, s2 +2 moreSonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- sonos era 300, s1, s2 +2 moreSonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability8.8 High
- luxion keyshotLuxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability7.8 High
- luxion keyshotLuxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability7.8 High
- luxion keyshot, keyshot viewer +1 moreLuxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- redis, debian linux, lfprojects valkey +2 moreRedis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client7.5 High
- dataeaseDataease H2 JDBC Connection Remote Code Execution8.2 High
- refraction-networking utlsuTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API9.3 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API8.6 High
- pnpmpnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting6.5 Medium
vkucrates.io`VMABuffer::set_data` may allow out-of-bounds writes from safe codeNo scoremacroquadcrates.iomacroquad vulnerable to multiple soundness issues8.7 High- grafana, grafana enterprise +1 moreThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor...6.8 Medium
- meon bidding solutionsImproper Access Control Vulnerability in Meon Bidding Solutions9.3 Critical
- meon kyc solutionsDetailed Error Response Vulnerability in Meon KYC solutions6.9 Medium
- meon kyc solutionsInformation Disclosure Vulnerability in Meon KYC solutions8.7 High
- meon kyc solutionsImproper Authentication Vulnerability in Meon KYC solutions8.2 High
- meon kyc solutionsCaptcha Bypass Vulnerability in Meon KYC solutions8.2 High
- meon kyc solutionsBrute Force Attack Vulnerability in Meon KYC solutions8.2 High
- red hat enterprise linux 10, enterprise linux 9, enterprise linux 9.4 extended update support +2 more +4 moreMod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests5.4 Medium
- uicore elements – free widgets and templates for elementorUiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- codesys visualizationForced Browsing Vulnerability in CODESYS Visualization5.3 Medium
- mra13 simple shopping cartWordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation7.5 High
- Show moreLoading…