CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- dassault systèmes solidworks edrawingsUse-After-Free vulnerability exists in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 20257.8 High
- dassault systèmes solidworks edrawingsOut-Of-Bounds Write vulnerability exists in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 20257.8 High
- hashicorp vault, vault enterprise, openbao +2 moreVault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin4.5 Medium
- digigram pyko-outCVE-2025-39279.8 Critical
- debian linux, linux kernel +1 morecodel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()7.8 High
- debian linux, linux kernel +1 morenet_sched: hfsc: Fix a UAF vulnerability in class handling7.8 High
- honeywell mb-secure, mb-secure firmware, mb-secure pro firmware +2 moreAuthenticated command injection9.9 Critical
- inception software llp ultimate auction pro, auctionplugin ultimate wordpress auction plugin +1 moreUltimate Auction Pro <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id'7.5 High
- felisify sambaboxXSS in Profelis Informatics' SambaBox6.1 Medium
- felisify sambaboxRemote Code Execution in Profelis Informatics' SambaBox9.8 Critical
- yordam library automation systemReflected XSS in Yordam Informatics' Library Automation System6.1 Medium
- mydata ticket sales automationSQLi in Mydata Informatics' Ticket Sales Automation9.8 Critical
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- gosoft software proticaret e-commerce, proticaret +1 moreCSRF in Gosoft Software's Proticaret E-Commerce8.8 High
- boss media buddyboss platform, buddyboss platform +1 moreBuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function6.4 Medium
- boss media buddyboss platform, buddyboss platform +1 moreBuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'6.4 Medium
- boss media buddyboss platform, buddyboss theme, buddyboss platform +2 moreBuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'6.4 Medium
- brainstormforce sureformsSureForms < 1.4.4 - Admin+ Stored XSS3.5 Low
- brainstormforce sureformsSureForms < 1.4.4 - Admin+ Stored XSS3.5 Low
- inspireui mstore api – create native android & ios apps on the cloud, mstore api +1 moreMStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation6.5 Medium
- wpmlWPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode6.4 Medium
- giorgi formalityFormality <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter6.4 Medium
- fave themes homeyHomey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion4.3 Medium
- g5plus april, auteur, benaa +5 more +7 moreSmart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- g5plus april, auteur, benaa +5 more +7 moreSmart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates4.3 Medium
- scripteo ads pro plugin - multi-purpose wordpress advertising manager, ads pro +1 moreAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection7.5 High
- fullservices full – clienteFULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- tagdiv composertagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- fave themes homeyHomey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion4.3 Medium
- smartcms advance seat reservation management for woocommerceAdvance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection7.5 High
- pluginus taxonomy chain menuTaxonomy Chain Menu <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu Shortcode6.4 Medium
- g5plus april, auteur, benaa +5 more +7 moreSmart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- berabuddies agentflowFlowring Technology Agentflow - Account Lockout Bypass9.8 Critical
- le-show le-yan, le-yan le-show +1 moreLe-show Medical Practice Management System - SQL Injection9.8 Critical
- sun.net ehrd ctmsSunnet eHRD CTMS - SQL Injection6.5 Medium
- flynax bridge, v1rustyle flynax bridge +1 moreFlynax Bridge <= 2.2.0 - Unauthenticated Arbitrary User Deletion5.3 Medium
- kiwichat nextclientKiwiChat NextClient <= 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter6.4 Medium
- yame | link in bioYame | Link In Bio <= 0.9.0 - Unauthenticated Information Exposure5.3 Medium
- flynax bridge, v1rustyle flynax bridge +1 moreFlynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation7.3 High
- thedrifted otp-less one tap sign inOTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation9.8 Critical
- garubi gmapsmaniaGmapsMania <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- code-projects patient record management systemcode-projects Patient Record Management System edit_xpatient.php sql injection5.3 Medium
- code-projects patient record management systemSourceCodester Patient Record Management System birthing.php sql injection5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.5 Medium
- admerc gym management systemitsourcecode Gym Management System ajax.php sql injection6.9 Medium
- adonesevangelista restaurant management systemitsourcecode Restaurant Management System category_update.php sql injection6.9 Medium
- ibm concert, concert software +1 moreIBM Concert Software server-side request forgery6.5 Medium
- ibm concert, concert software +1 moreIBM Concert Software path traversal5.3 Medium
- ibm concert, concert software +1 moreIBM Concert Software information disclosure5.9 Medium
- ibm concert, concert software +1 moreIBM Concert Software denial of service6.5 Medium
- Show moreLoading…