CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- samsung android, samsung mobile devices +1 moreImproper handling of insufficient permission in SpenGesture service prior to SMR May-2025 Release...4.0 Medium
- samsung android, samsung mobile devices +1 moreImproper handling of insufficient permission or privileges in sepunion service prior to SMR May...5.5 Medium
- samsung android, samsung mobile devices +1 moreImproper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release...4.0 Medium
- samsung android, samsung mobile devices +1 moreUse of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper verification of intent by broadcast receiver in UnifiedWFC prior to SMR May-2025 Release...4.4 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers...7.3 High
- samsung wear os, samsung mobile devices +1 moreImproper export of android application components in Settings in Galaxy Watch prior to SMR May...4.3 Medium
- samsung android, samsung mobile devices +1 moreImproper Export of Android Application Components in NotificationHistoryImageProvider prior to...5.5 Medium
- samsung android, samsung mobile devices +1 moreUse of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release...5.5 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers...5.1 Medium
- samsung membersPath traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to...5.1 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged...6.7 Medium
- boinc server, universityofcalifornia boinc server +1 moreBOINC Server Cross-Site Request Forgery8.6 High
- boinc server, universityofcalifornia boinc server +1 moreBOINC Server Multiple SQL Injections9.3 Critical
- boinc server, universityofcalifornia boinc server +1 moreBOINC Server Stored XSS Injection in pm.php8.7 High
- boinc server, universityofcalifornia boinc server +1 moreBOINC Server Stored XSS Injection in host_venue_action.php7.0 High
- ajay wz followed posts – display what visitors are readingWZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- rt-labs p-netAn Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a...7.5 High
- rt-labs p-netAn Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt...4.8 Medium
- rt-labs p-netAn Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt...4.8 Medium
- rt-labs p-netAn Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a...7.5 High
- rt-labs p-netAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to...4.8 Medium
- rt-labs p-netAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to...7.5 High
- rt-labs p-netAn Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an...5.3 Medium
- rt-labs p-netA NULL Pointer Dereference in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce...7.5 High
- rt-labs p-netAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to...7.5 High
- rt-labs p-netAn Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to...7.5 High
- libplctagOut-of-bounds Read in libplctag library3.1 Low
- libplctagOut-of-bounds Read in libplctag library3.1 Low
- webfactory login lockdown & protectionLogin Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting5.4 Medium
- comesio relevanssi – a better search, relevanssi premium, unknown relevanssi premium +2 moreRelevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights6.1 Medium
- xavinnydek xavin's list subpagesXavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- josj404 multiple post type orderMultiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode6.4 Medium
- dealertrend cardealerpressCarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter6.4 Medium
- n3wnormal woocommerce multiple addressesWoocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function8.2 High
- eoxia wpshop 2 – e-commerceWPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration5.3 Medium
- themesgrove download manager and payment form wordpress plugin – wp smartpayDownload Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure4.3 Medium
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover9.8 Critical
- eoxia wpshop 2 – e-commerceWPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation6.5 Medium
- quadlayers search excludeSearch Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification5.3 Medium
- ibm iIBM i improper certificate validation5.4 Medium
- pwsdashboard personal weather station dashboardPersonal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read...5.8 Medium
- dropbear ssh project sshdbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname...4.5 Medium
- tenda fh451 firmwareTenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.frmL7ImForm.6.5 Medium
- No product listedWagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload...6.1 Medium
- benjaminjonard koillectionKoillection Cross Site Scripting vulnerability6.1 Medium
- flatpressflatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage...6.1 Medium
- Show moreLoading…