CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- phpgurukul nipah virus testing management systemPHPGurukul Nipah Virus Testing Management System edit-phlebotomist.php sql injection6.9 Medium
- pixel prime reales wp stptReales WP STPT <= 2.1.2 - Unauthorized User Registration5.3 Medium
- pixel prime reales wp stptReales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update8.8 High
- kefaming mayikefaming mayi File.php upload unrestricted upload5.3 Medium
- phpgurukul cyber cafe management systemPHPGurukul Cyber Cafe Management System adminprofile.php sql injection6.9 Medium
- unisoc (shanghai) technologies co., ltd. sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t750/t765/t760/t770/t820/s8000/t8300/t9300In sprd ssense service, there is a possible missing permission check. This could lead to local...6.2 Medium
- phpgurukul human metapneumovirus testing management systemPHPGurukul Human Metapneumovirus Testing Management System add-phlebotomist.php sql injection6.9 Medium
- google chromeos, chrome os +1 moreOut-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to...7.8 High
- cpp-httplib project cpp-httplibcpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests7.5 High
github.com/inspektor-gadget/inspektor-gadgetGoInspektor Gadget Security Policies Can be Bypassed6.7 Medium- code-projects content management systemitsourcecode Content Management System search-notice.php sql injection6.9 Medium
- code-projects content management systemitsourcecode Content Management System search_list.php sql injection6.9 Medium
- tenda ac1206, ac1206 firmware +1 moreTenda AC1206 openSchedWifi setSchedWifi buffer overflow8.7 High
- libxmpLibxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c...5.6 Medium
- netgear ex8000 firmwareNetgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the...9.8 Critical
- linksys e5600 firmwareLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the...9.8 Critical
- linksys e5600 firmwareLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the...9.8 Critical
- linksys e5600 firmwareLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the...9.8 Critical
- linksys e5600 firmwareLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the...9.8 Critical
- linksys e5600 firmwareLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the...9.8 Critical
- mrdocMrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url...5.5 Medium
- tenda rx3 firmwareIn Tenda RX3 V1.0br_V16.03.13.11 in the GetParentControlInfo function of the web url /goform...6.5 Medium
- tenda rx3 firmwareThere is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the...9.8 Critical
- seacmsSeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component...9.8 Critical
- No product listedAn issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5...6.5 Medium
- No product listedReal Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via...5.1 Medium
- tenda ac1206, ac1206 firmware +1 moreTenda AC1206 setcfm formSetCfm buffer overflow8.7 High
- phpgurukul men salon management systemPHPGurukul Men Salon Management System change-password.php sql injection6.9 Medium
- mrcmsMRCMS Group Edit Page edit.do cross site scripting4.8 Medium
- mrcmsMRCMS Edit User Page edit.do cross site scripting4.8 Medium
- ideacmsIdeaCMS saveUpload unrestricted upload5.3 Medium
- pcman ftp serverPCMan FTP Server SMNT Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server RNTO Command buffer overflow6.9 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- pcman ftp serverPCMan FTP Server RNFR Command buffer overflow6.9 Medium
- discoursePrivate data leak on login-required Discourse sites5.8 Medium
- pytorchPyTorch nccl.py torch.cuda.nccl.reduce denial of service4.8 Medium
- thephpleague commonmarkleague/commonmark Cross-site Scripting vulnerability in Attributes extension6.4 Medium
- buddyboss platform pro, platform +1 moreBuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider9.8 Critical
- craftcms cms, craft cms +1 moreCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI7.3 High
- opensecurity mobile security framework, mobsf mobile-security-framework-mobsf +1 moreMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack6.8 Medium
- intelbras incontrol, incontrol web +1 moreIntelbras InControl Dispositivos Edição Page credentials storage5.1 Medium
- langroidLangroid Vulnerable to XXE Injection via XMLToolMessage7.8 High
- hcl bigfix complianceHCL BigFix Compliance is affected by inclusion of temporary files left in the production environment5.3 Medium
- keystonejs keystoneKeystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields3.1 Low
- open-webui, openwebui open webui +1 moreOpen WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI vulnerable to limited stored XSS vila uploaded html file5.3 Medium
- hcl bigfix complianceHCL BigFix Compliance is affected by an improper or missing SameSite attribute5.4 Medium
- Show moreLoading…