CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- palo alto networks globalprotect app, globalprotect uwp app, paloaltonetworks globalprotect +2 moreGlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App5.2 Medium
- palo alto networks cortex xdr broker vmCortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM6.5 Medium
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal1.2 Low
- palo alto networks cortex xdr broker vmCortex XDR Broker VM: Unauthenticated User Can Disable Internal Services6.9 Medium
- pointcloudlibrary pclOut-of-bounds Write in pcl8.3 High
- opswat metadefender endpoint security sdkGlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK7.1 High
- drupal one time password, one time password project time password +1 moreOne Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-0634.8 Medium
- drupal one time password, one time password project time password +1 moreOne Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-0624.8 Medium
- drupal one time password, one time password project time password +1 moreOne Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-0614.8 Medium
- drupal single content sync, single content sync project content sync +1 moreSingle Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-0603.1 Low
- drupal events log track, events log track project log track +1 moreEvents Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-0597.5 High
- drupal piwik proPiwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0584.8 Medium
drupal/advanced_file_destinationPackagistThe Advanced File Destination module enhances file upload management in Drupal by allowing users to choose and create custom directories during file uploads. The module has multiple vulnerabilities th…No score- peergosImproper Restriction of XML External Entity Reference in Peergos8.8 High
- pointcloudlibrary pcl, pointclouds point cloud library +1 moreImproper Pointer Arithmetic in pcl9.2 Critical
- davisking dlibDivide By Zero in dlib8.7 High
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - Cross-site Scripting4.3 Medium
- zoom communications, inc workplace apps, zoom meeting software development kit, rooms +3 more +5 moreZoom Workplace Apps for Windows - Buffer Over-read6.5 Medium
- google chromeInsufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a...4.3 Medium
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - NULL Pointer Dereference6.5 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets8.2 High
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - NULL Pointer Dereference6.5 Medium
github.com/cosmos/evmGoCosmos EVM Allows Partial Precompile State Writes8.3 High- zoom communications, inc workplace apps for windows, zoom meeting software development kit, rooms +3 more +5 moreZoom Workplace Apps for Windows - NULL Pointer Dereference6.5 Medium
- zoom communications, inc workplace apps for windows, zoom meeting software development kit, rooms +3 more +5 moreZoom Workplace Apps for Windows - NULL Pointer Dereference6.5 Medium
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - Cross-site Scripting6.6 Medium
- zoom workplace, zoom communications, inc workplace apps, zoom meeting software development kit +4 more +6 moreZoom Workplace Apps - Time-of-check Time-of-use8.8 High
- mozilla thunderbirdTracking Links in Attachments Bypassed Remote Content Blocking6.5 Medium
- mozilla thunderbirdJavaScript Execution via Spoofed PDF Attachment and file:/// Link8.1 High
- mozilla thunderbirdSender Spoofing via Malformed From Header in Thunderbird7.5 High
- sonicwall sma1000A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance...7.2 High
- motioneye-project motioneyemotionEye vulnerable to RCE in add_camera Function Due to unsafe command execution8.9 High
- lukevella ralllyRallly Insufficient Password Login Token Entropy Leads to Account Takeover9.8 Critical
- suluSulu vulnerable to XXE in SVG File upload Inspector6.1 Medium
- 5ire5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)9.7 Critical
- bullfrogsec bullfrogBullfrog's DNS over TCP bypasses domain filtering6.2 Medium
- combodo itopiTop portal user can see any other contact's picture5.0 Medium
- combodo itopiTop dashboard vulnerable to denial of service4.3 Medium
- combodo itopiTop Inefficient Regular Expression Complexity vulnerability5.3 Medium
- combodo itopiTop server vulnerable to portal code injection8.6 High
- combodo itopiTop doesn't have mass assignment of fields in the portal form5.0 Medium
- combodo itopiTop vulnerable to Self XSS in CSV Import6.3 Medium
- combodo itopiTop portal Insecure Direct Object Reference vulnerability6.5 Medium
- opentext advance authenticationReflected Cross-Site Scripting vulnerability in OpenText Advanced Authentication9.4 Critical
- opentext advance authenticationSQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication.7.5 High
- progress telerik ui for asp.net ajaxUnsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- apache orcApache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression6.0 Medium
- linux, linux kernel +1 moremedia: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()5.5 Medium
- arraytics eventinWordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability7.5 High
- latepoint – calendar booking plugin for appointments and eventsLatepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference5.3 Medium
- Show moreLoading…