CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
hugepage-rscrates.io`hugepage_rs::dealloc` may allow invalid memory deallocation from safe codeNo scorestainless_ffmpegcrates.io`FormatContext` stream accessors can cause undefined behavior from safe codeNo scorei_trianglecrates.io`DTriangle` accessors may read out of bounds in affected versionsNo scorearrow2crates.ioArrow2 allows out of bounds access in public safe API8.7 Hightanton_enginecrates.iotanton_engine has unsound public APINo score- apache httpclient, apache software foundation httpcomponents, netapp ontap tools +2 moreApache HttpComponents: PSL (Public Suffix List) validation bypass7.5 High
- franka robotics emika robotEnumeration of valid user names5.3 Medium
- franka robotics emika robotImproper session handling8.1 High
- franka robotics emika robotUnauthenticated remote shutdown of the cobot7.5 High
- centreon, centreon web +1 morePrivilege escalation by altering payload in contact form7.2 High
- flynax bridge, v1rustyle flynax bridge +1 moreFlynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update9.8 Critical
- lamarant buddypress force password changeBuddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update4.2 Medium
- cajka verification sms with targetsmsVerification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution8.3 High
- elextensions elex woocommerce bulk edit products, prices & attributes (basic)ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- pixel prime reales wp - real estate wordpress themeReales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates5.3 Medium
- jeremyshapiro fusedeskFuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter6.4 Medium
- ludwigyou wpmastertoolkit (wpmtk) – all in one pluginWPMasterToolKit (WPMTK) – All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write7.2 High
- bplugins lottie player – add interactive lottie animations with block supportLottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload6.4 Medium
- arkenon login, registration and lost password blocksFrontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset8.8 High
- flynax bridge, v1rustyle flynax bridge +1 moreFlynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- wp-configurator configurator theme coreConfigurator Theme Core <= 1.4.7 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- spiderdevs advanced accordion gutenberg block – create beautiful faqs, content accordions & interactive tabsAdvanced Accordion Gutenberg Block <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- xpertsclub woocommerce automatic order printing | ( formerly woocommerce google cloud print)Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure4.3 Medium
- neoslab database toolsetDatabase Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion9.1 Critical
- jauharixelion xelion webchatXelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabBusiness Logic Errors in GitLab7.7 High
- joedolson my tickets – accessible event ticketingMy Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- mattermost, mattermost server +1 moreUnauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin3.1 Low
- mattermost, mattermost server +1 moreDoS in Mattermost Playbooks via Excessive Task Actions6.5 Medium
- mattermost, mattermost server +1 moreWebapp DoS via malicious retrospective post in Playbooks6.5 Medium
- i-pro co., ltd. configuration toolUse of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network...6.8 Medium
- the wound project wound, unknown the-wound +1 moreThe Wound <= 0.0.1 - Unauthenticated LFI8.6 High
- unknown category posts widgetCategory Posts Widget < 4.9.20 - Admin+ Stored XSS4.8 Medium
- kitae-park mang board wpMangBoard WP <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer4.4 Medium
- broadcom brocade fabric os, brocade fabric os, broadcom fabric operating system +2 moreCode injection exposure in Fabric OS 9.1.0 through 9.1.1d68.6 High
- westermo weosWestermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.5.9 Medium
- code-projects online class and exam scheduling systemA vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in ...6.5 Medium
- code-projects online class and exam scheduling systemA vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the...6.5 Medium
- code-projects online class and exam scheduling systemA vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System...4.8 Medium
- No product listedITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL...6.5 Medium
- codeastro bus ticket booking systemInsecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows...8.0 High
- bluegrams youtubedlsharpYoutubeDLSharp allows command injection on windows system due to non sanitized arguments9.2 Critical
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure3.7 Low
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure4.3 Medium
- hiyouga llama-factoryLLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py6.1 Medium
- ibm infosphere information serverIBM InfoSphere Information Server session fixation6.3 Medium
- fig2dev project fig2dev, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreXfig: fig2dev segmentation fault in read_arcobject5.5 Medium
- fig2dev project fig2dev, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreXfig: transfig: fig2dev segmentation fault vulnerability5.5 Medium
- Show moreLoading…