CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreSQL Injection8.1 High
- manageengine adselfservice plus, zohocorp manageengine adselfservice plus +1 moreSQL Injection8.1 High
- cap-collectifCap Collectif vulnerable to insecure deserialization leading to remote code execution9.5 Critical
- apache iotdbApache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication7.5 High
- apache iotdb, apache software foundation iotdb jdbc driver +1 moreApache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver7.5 High
- apache iotdbApache IoTDB: Remote Code Execution with untrusted URI of User-defined function9.8 Critical
- naukowa i akademicka sieć komputerowa - państwowy instytut badawczy ezd rpUnauthorized file manipulation in EZD RP8.6 High
- linux, linux kernel +1 morecifs: Fix memory and information leak in smb3_reconfigure()5.5 Medium
- linuxs390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP7.8 High
- linuxarm64: set __exception_irq_entry with __irq_entry as a default7.8 High
- linuxovl: fix null pointer dereference in ovl_get_acl_rcu()5.7 Medium
- linuxs390/vmem: split pages when debug pagealloc is enabled7.8 High
- linuxamba: bus: fix refcount leak7.8 High
- linuxs390/dcssblk: fix kernel crash with list_add corruption7.8 High
- linuxvirtio_pmem: add the missing REQ_OP_WRITE for flush bio7.8 High
- linuxarm64: mm: fix VA-range sanity check7.8 High
- linuxs390/idle: mark arch_cpu_idle() noinstr7.8 High
- linux, linux kernel +1 moreocteontx2-af: Add validation before accessing cgx and lmac5.5 Medium
- linux, linux kernel +1 moreocteontx2-pf: mcs: Fix NULL pointer dereferences5.5 Medium
- linux, linux kernel +1 mores390/zcrypt: don't leak memory if dev_set_name() fails5.5 Medium
- linux, linux kernel +1 moremm/damon/core: initialize damo_filter->list from damos_new_filter()5.5 Medium
- linux, linux kernel +1 moremedia: v4l2-mem2mem: add lock to protect parameter num_rdy5.5 Medium
- linux, linux kernel +1 morescsi: ufs: core: Fix handling of lrbp->cmd7.8 High
- linux, linux kernel +1 moreusb: cdns3: Put the cdns set active part outside the spin lock5.5 Medium
- linux, linux kernel +1 morecoresight: Fix memory leak in acpi_buffer->pointer5.5 Medium
- linux, linux kernel +1 moreovl: fix null pointer dereference in ovl_permission()5.5 Medium
- linux, linux kernel +1 moreusb: dwc3: qcom: Fix potential memory leak5.5 Medium
- linuxerofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails5.3 Medium
- linuxerofs: Fix pcluster memleak when its block address is zero7.8 High
- linuxmisc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic7.8 High
- linux, linux kernel +1 morelib/fonts: fix undefined behavior in bit shift for get_default_font5.5 Medium
- linux, linux kernel +1 morecoresight: cti: Fix hang in cti_disable_hw()5.5 Medium
- linux, linux kernel +1 morerpmsg: char: Avoid double destroy of default endpoint7.8 High
- linux, linux kernel +1 morecoresight: trbe: remove cpuhp instance node before remove cpuhp state5.5 Medium
- linux, linux kernel +1 morecoresight: Clear the connection field properly7.8 High
- linux, linux kernel +1 moreof: check previous kernel's ima-kexec-buffer against memory bounds5.5 Medium
- linux, linux kernel +1 moreremoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init5.5 Medium
- linux, linux kernel +1 morerpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge5.5 Medium
- schneider electric modicon controllers m241 / m251, modicon controllers m258 / lmc058 +1 moreCWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists...8.7 High
- peepso core: file uploadsPeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download5.3 Medium
- ninja forms webhooksNinja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook5.5 Medium
- lf-edge ekuiperStored XSS in Configuration Key Functionality6.3 Medium
screenAlpaquitaScreen creates by default world-writable PTYs5.1 MediumscreenAlpaquitaLocal root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit set7.3 High- uncannyowl uncanny automator, uncanny automator – easy automation, integration, webhooks & workflow builder plugin +1 moreUncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update5.4 Medium
- uncannyowl uncanny automator, uncanny automator – easy automation, integration, webhooks & workflow builder plugin +1 moreUncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function9.1 Critical
jqOSS-FuzzHeap-buffer-overflow in jv_string_vfmtNo score- nbdkit project nbdkit, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreNbd: nbdkit: integer overflow triggers an assertion resulting in denial of service6.5 Medium
- nbdkit project nbdkit, red hat enterprise linux 10, enterprise linux 7 +5 more +7 moreNbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service6.5 Medium
- No product listedWS-WN572HP3 V230525 was discovered to contain a buffer overflow in the component /www/cgi-bin...7.5 High
- Show moreLoading…