CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- debian linux, linux kernel +1 moremedia: venus: hfi_parser: refactor hfi packet parsing logic7.8 High
- linux, linux kernel +1 morenet: stmmac: Fix accessing freed irq affinity_hint7.1 High
- linux, linux kernel +1 moreio_uring/net: fix io_req_post_cqe abuse by send bundle5.5 Medium
- linux, linux kernel +1 morearm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()5.5 Medium
- linux, linux kernel +1 morearm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()5.5 Medium
- debian linux, linux kernel +1 morebus: mhi: host: Fix race between unprepare and queue_buf7.8 High
- debian linux, linux kernel +1 moreext4: fix off-by-one error in do_split7.8 High
- linux, linux kernel +1 moretpm: do not start chip while suspended5.5 Medium
- debian linux, linux kernel +1 moresoc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()5.5 Medium
- debian linux, linux kernel +1 morei3c: Add NULL pointer check in i3c_master_queue_ibi()5.5 Medium
- debian linux, linux kernel +1 moremfd: ene-kb3930: Fix a potential NULL pointer dereference5.5 Medium
- debian linux, linux kernel +1 moremptcp: fix NULL pointer in can_accept_new_subflow7.5 High
- debian linux, linux kernel +1 morebacklight: led_bl: Hold led_access lock when calling led_sysfs_disable()5.5 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +5 more +7 morenet: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.5.5 Medium
- debian linux, linux kernel +1 moresctp: detect and prevent references to a freed transport in sendmsg7.8 High
- debian linux, linux kernel +1 moreKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses7.8 High
- debian linux, linux kernel +1 moremisc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error5.5 Medium
- phpgurukul employee record management systemPHPGurukul Employee Record Management System changepassword.php sql injection6.9 Medium
- phpgurukul land record systemPHPGurukul Land Record System aboutus.php sql injection5.3 Medium
- mra13 simple shopping cart, tipsandtricks-hq wordpress simple paypal shopping cart +1 moreWordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mra13 simple shopping cart, tipsandtricks-hq wordpress simple paypal shopping cart +1 moreWordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'5.3 Medium
- mra13 simple shopping cart, tipsandtricks-hq wordpress simple paypal shopping cart +1 moreWordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference6.5 Medium
- johanaarstein am lottieplayerAM LottiePlayer <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File6.4 Medium
- pcman ftp serverPCMan FTP Server ASCII Command buffer overflow6.9 Medium
- brainstorm force ottokitWordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability9.8 Critical
- pcman ftp serverPCMan FTP Server VERBOSE Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server LS Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server GLOB Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server PROMPT Command buffer overflow6.9 Medium
- phpgurukul boat booking systemPHPGurukul Boat Booking System booking-details.php sql injection5.3 Medium
- phpgurukul boat booking systemPHPGurukul Boat Booking System change-image.php sql injection5.3 Medium
- phpgurukul boat booking systemPHPGurukul Boat Booking System edit-boat.php sql injection5.3 Medium
- phpgurukul pre-school enrollment systemPHPGurukul Pre-School Enrollment System enrollment-details.php sql injection5.3 Medium
- wpspeedo team members showcaseTeam Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- stur nautic pagesNautic Pages <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- phpgurukul park ticketing management systemPHPGurukul Park Ticketing Management System profile.php sql injection6.9 Medium
- phpgurukul online birth certificate systemPHPGurukul Online Birth Certificate System bwdates-reports-details.php sql injection6.9 Medium
- unknown wp mapsWP Maps < 4.7.2 - Admin+ Stored XSS4.8 Medium
- unknown wp mapsWP Maps < 4.7.2 - Admin+ Stored XSS4.8 Medium
- unknown wp mapsWP Maps < 4.7.2 - Admin+ Stored XSS4.8 Medium
- codepeople calculated fields formCalculated Fields Form < 5.2.62 - Admin+ Stored XSS4.8 Medium
- phpgurukul curfew e-pass management systemPHPGurukul Curfew e-Pass Management System pass-bwdates-reports-details.php sql injection6.9 Medium
- netgear ex6200, ex6200 firmware +1 moreNetgear EX6200 sub_54340 buffer overflow8.7 High
- projectopia, projectopia – project management tool +1 moreProjectopia – WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion8.1 High
- gravity forms webhooks, rocketgenius gravity forms webhooks +1 moreGravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook5.5 Medium
- sizeable list childrenList Children <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- netgear ex6200, ex6200 firmware +1 moreNetgear EX6200 sub_54014 buffer overflow8.7 High
- bdthemes ultimate store kit, ultimate store kit – addon for woocommerce, edd and elementor +1 moreUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Me…4.3 Medium
- spicethemes newsbloggerNewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation8.8 High
- spicethemes newsbloggerNewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- Show moreLoading…