CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- mattermost, mattermost server +1 moreRepeated LDAP login failures can lock an LDAP account5.8 Medium
- i-o data device, inc. hdl-t1nv, hdl-t1wh, hdl-t2nv +5 more +7 moreMissing authentication for critical function issue exists in I-O DATA network attached hard disk ...6.9 Medium
- i-o data device, inc. hdl-t1nv, hdl-t1wh, hdl-t2nv +5 more +7 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...9.3 Critical
- tecno com.transsion.aivoiceassistantInsufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant)...6.2 Medium
- hitachi jp1/it desktop management 2 - smart device managerInformation Exposure vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager3.9 Low
- hitachi jp1/it desktop management 2 - smart device managerWeak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager5.3 Medium
- hitachi jp1/it desktop management 2 - smart device managerXXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager8.7 High
- dfactory responsive lightbox, unknown responsive lightbox & gallery +1 moreResponsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSS6.8 Medium
- wp experts file manager advanced shortcodeFile Manager Advanced Shortcode <= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode7.2 High
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution8.8 High
- welukame weluka liteWeluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- emmanuelg eg-seriesEG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- nackle2k10 bon toolkitBon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- kelerkgibo seo合集(支持百度/google/bing/头条推送)百度站长SEO合集(支持百度/神马/Bing/头条推送) <= 2.0.6 - Unauthenticated Arbitrary File Upload9.8 Critical
- dyland wp content security pluginWP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fields7.2 High
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo scorepcapplusplusOSS-FuzzHeap-buffer-overflow in __parse_optionsNo score- lichess lila, powertip.ts +1 morepowertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an...4.7 Medium
- cure53 dompurifyIn DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is...7.5 High
- mutonufoai pgina.forkThe HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary...5.4 Medium
- bluewave checkmateIn BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application...5.0 Medium
- google chromeIncorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior...9.6 Critical
- weberpA SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL...5.1 Medium
- weberpAn error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute...9.8 Critical
- mayurik best employee management systemSourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery ...5.4 Medium
- anujk305 vehicle record management systemPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in ...6.1 Medium
- anujk305 vehicle record management systemPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via...6.1 Medium
- anujk305 vehicle record management systemPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in ...6.1 Medium
- anujk305 vehicle record management systemPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in ...6.1 Medium
- fluxbbFluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in...5.4 Medium
- insyde kernelAn issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before...7.9 High
- insyde insydeh2oAn issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before...7.5 High
- insyde insydeh2oAn issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before...7.5 High
- insyde insydeh2oAn issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before...7.5 High
- humansignal label-studio, label studio +1 morelabel-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.7.6 High
- ecki net-tools, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +12 more +14 morenet-tools Stack-based Buffer Overflow vulnerability6.6 Medium
- vercel next.jsNext.js Race Condition to Cache Poisoning3.7 Low
- No product listedIncorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18...5.4 Medium
- jenkins wso2 oauth, jenkins project wso2 oauth plugin +1 moreJenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials9.8 Critical
- jenkins dingtalk, jenkins project dingtalk plugin +1 moreJenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation5.9 Medium
- jenkins cadence vmanager, jenkins project cadence vmanager plugin +1 moreJenkins Cadence vManager Plugin is Missing Permission Checks4.3 Medium
- jenkins cadence vmanager, jenkins project cadence vmanager plugin +1 moreJenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery4.3 Medium
- jenkins health advisor by cloudbees, jenkins project health advisor by cloudbees plugin +1 moreJenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting8.8 High
- jenkins openid connect provider, jenkins project openid connect provider plugin +1 moreJenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens9.1 Critical
- ibm websphere application serverIBM WebSphere Application Server cross4.4 Medium
- ibm semeru runtimeIBM Semeru Runtime denial of service7.5 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices5.3 Medium
- palo alto networks compute in prisma cloud enterprise edition, prisma cloud compute edition +1 morePrisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web Interface2.0 Low
- palo alto networks pan-os, cloud ngfw +1 morePAN-OS: Improper Neutralization of Input in the Management Web Interface4.8 Medium
- bonigarcia webdrivermanagerXML External Entity (XXE) injection vulnerability in WebDriverManager9.3 Critical
- Show moreLoading…