CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- misskeyMisskey Directory Traversal Vulnerability in AiScript via `Mk:api`5.4 Medium
- misskeyMisskey CSS Style Injection Vulnerability In `MkUrlPreview`7.2 High
- oretnom23 stock management systemSourceCodester/oretnom23 Stock Management System Login.php sql injection6.9 Medium
- muro external image replaceExternal image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-021_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-020_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-019_Retrieval-based-Voice-Conversion-WebUI8.9 High
- amazon amplify studioInput validation issue in AWS Amplify Studio UI component properties9.0 Critical
- oretnom23 stock management systemSourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery5.3 Medium
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-018_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-017_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-016_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-015_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-014_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-013_Retrieval-based-Voice-Conversion-WebUI8.9 High
- rvc-project retrieval-based-voice-conversion-webuiGHSL-2025-012_Retrieval-based-Voice-Conversion-WebUI8.9 High
- citeum openctiOpenCTI has remote code execution and sensitive secrets exposed through web hook9.1 Critical
- misskey summaly@misskey-dev/summaly Redirect Filter Bypass2.1 Low
- beyondtrust privileged remote accessPrivileged Remote Access Authentication Bypass7.3 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- themekalia envolve pluginEnvolve Plugin <= 1.0 - Unauthenticated Language File Deletion5.3 Medium
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosure5.3 Medium
- opensecurity mobile security framework, mobsf mobile-security-framework-mobsf +1 moreMobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload8.6 High
- octobercms octoberOctober CMS Allows Unprotected SVG Rename in Media Manager1.1 Low
- linux, linux kernel +1 morebpf: consider that tail calls invalidate packet pointers7.8 High
- linux, linux kernel +1 morebpf: check changes_pkt_data property for extension programs7.8 High
- linux, linux kernel +1 morebpf: track changes_pkt_data property for global functions7.8 High
- devolutions serverImproper access control in PAM feature in Devolutions Server 2025.1.6.0 and earlier allows a PAM...4.3 Medium
- mechrevo control consoleMechrevo Control Console GCUService csCAPI.dll uncontrolled search path7.3 High
- wso2 api manager, enterprise integrator, enterprise service bus +2 more +4 moreAn XML External Entity (XXE) vulnerability in Multiple WSO2 Products9.1 Critical
- totolink a720r, a720r firmware +1 moreTOTOLINK A720R cstecgi.cgi information disclosure6.9 Medium
- totolink a720r, a720r firmware +1 moreTOTOLINK A720R Config cstecgi.cgi information disclosure6.9 Medium
- totolink a720r, a720r firmware +1 moreTOTOLINK A720R Log cstecgi.cgi access control6.9 Medium
- totolink a720r, a720r firmware +1 moreTOTOLINK A720R cstecgi.cgi missing authentication6.9 Medium
- alphaefficiencyteam custom login and registrationWordPress Custom Login and Registration <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- oretnom23 stock management systemSourceCodester/oretnom23 Stock Management System Purchase Order Details Page view_po sql injection5.1 Medium
- stefano lissa newsletterNewsletter < 8.7.1 - Admin+ Stored XSS4.8 Medium
- anujk305 notice board systemPHPGurukul Notice Board System bwdates-reports-details.php sql injection6.9 Medium
- phpgurukul emergency ambulance hiring portalPHPGurukul Emergency Ambulance Hiring Portal contact-us.php sql injection6.9 Medium
- phpgurukul emergency ambulance hiring portalPHPGurukul Emergency Ambulance Hiring Portal edit-ambulance.php sql injection6.9 Medium
- phpgurukul online dj booking management systemPHPGurukul Online DJ Booking Management System booking-search.php sql injection6.9 Medium
- phpgurukul online dj booking management systemPHPGurukul Online DJ Booking Management System user-search.php sql injection6.9 Medium
- gair-nlp factoolGAIR-NLP factool tool.py run_single code injection4.8 Medium
- google android, mediatek, inc. mt6580, mt6761, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6983, mt6985, mt8175, mt8195, mt8196, mt8321, mt8365, mt8370, mt8385, mt8390, mt8395, mt8666, mt8667, mt8673, mt8678, mt8765, mt8766, mt8768, mt8771, mt8775, mt8781, mt8786, mt8788, mt8788e, mt8789, mt8791t, mt8795t, mt8796, mt8797, mt8798, mt8893 +1 moreIn devinfo, there is a possible information disclosure due to a missing SELinux policy. This...5.5 Medium
- mediatek nr16, nr17, nr17r +1 more +3 moreIn Modem, there is a possible permission bypass due to improper certificate validation. This...5.7 Medium
- google android, mediatek, inc. mt6878, mt6897, mt6899, mt6989, mt6991, mt8775, mt8796 +1 moreIn scp, there is a possible out of bounds write due to a missing bounds check. This could lead to...7.8 High
- google android, mediatek, inc. mt2718, mt6878, mt6897, mt6899, mt6989, mt6991, mt8196, mt8391, mt8676, mt8678 +1 moreIn thermal, there is a possible out of bounds write due to a race condition. This could lead to...7.0 High
- mediatek lr12a, lr13, nr15 +4 more +6 moreIn Modem, there is a possible information disclosure due to incorrect error handling. This could...7.5 High
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu TemplateController.java impsave deserialization5.3 Medium
- Show moreLoading…