CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- planet wgs-804hpt firmwareFW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey...6.5 Medium
- planet wgs-804hpt firmwareFW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter...6.5 Medium
- dlink di-8100 firmwareAn issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login...9.8 Critical
- orangehrmAn issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via the UserService.php and...7.2 High
- isc bind 9DNS message with invalid TSIG causes an assertion failure7.5 High
- No product listedAn issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate...8.4 High
- blizzard battle.netAn issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing...8.4 High
kernelopenEuler,linuxDebian,linux-6.1Debian +148 more +150 moreIEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks...9.1 Critical- onespan vasco self-service portalLocal File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain...6.5 Medium
- jeppesen jetplannerCross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker...6.1 Medium
- itech ilabclientitech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient...7.7 High
- itech-gmbh ilabclientThe local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext...5.5 Medium
- aapanelAAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.6.5 Medium
- moonlightl hexo-bootmoonlightL hexo-boot Blog Backend index.html cross site scripting4.8 Medium
- projectworlds online time table generatorprojectworlds Online Time Table Generator add_teacher.php sql injection6.9 Medium
- part-dbPart-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scripting5.1 Medium
- campcodes online shopping portalCampcodes Online Shopping Portal category.php sql injection6.9 Medium
- projectworlds online time table generatorprojectworlds Online Time Table Generator add_course.php sql injection6.9 Medium
- projectworlds online time table generatorprojectworlds Online Time Table Generator semester_ajax.php sql injection6.9 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System user_proposal_update_order.php sql injection6.9 Medium
- gnu psppGNU PSPP pspp-convert.c calloc integer overflow4.8 Medium
- linksys fgw3000-ah, fgw3000-hk, fgw3000-ah firmware +1 more +3 moreLinksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi control_panel_sw command injection5.3 Medium
- linksys fgw3000-ah, fgw3000-hk, fgw3000-ah firmware +1 more +3 moreLinksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi sub_4153FC command injection5.3 Medium
- h3c magic r200gH3C Magic R200G HTTP POST Request aspForm EditWlanMacList denial of service7.1 High
- cilium hubbleHubble CLI vulnerable to character injection5.3 Medium
- h3c r2+progH3C R2+ProG HTTP POST Request aspForm SetAPInfoById denial of service7.1 High
- intelbras rf 301kIntelbras RF 301K Add Static IP cross site scripting4.8 Medium
- containerdContainerd vulnerable to host filesystem access during image unpack7.6 High
- atlassian jira core data center, jira service management data center, jira core server +3 more +5 moreThis High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12...7.2 High
- assured telematics inc. fleet management systemExposure of Sensitive System Information to an Unauthorized Control Sphere8.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible4.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible4.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible4.8 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing...7.7 High
- vllmvLLM Allows Remote Code Execution via PyNcclPipe Communication Service9.8 Critical
- langroidLangroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store8.1 High
- langroidLangroid has a Code Injection vulnerability in TableChatAgent9.8 Critical
- debian linux, linux kernel +1 moreparisc: Fix double SIGFPE crash7.8 High
- debian linux, linux kernel +1 morewifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()5.5 Medium
- debian linux, linux kernel +1 morenet: phy: leds: fix memory leak5.5 Medium
- linux, linux kernel +1 morefix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()7.8 High
- linux, linux kernel +1 morepds_core: Prevent possible adminq overflow/stuck condition5.5 Medium
- linux, linux kernel +1 moreusb: typec: class: Invalidate USB device pointers on partner unregistration5.5 Medium
- debian linux, linux kernel +1 moreUSB: wdm: close race between wdm_open and wdm_wwan_port_stop4.7 Medium
- linux, linux kernel +1 morecrypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()7.0 High
- debian linux, linux kernel +1 moreqibfs: fix _another_ leak5.5 Medium
- debian linux, linux kernel +1 morewifi: wl1251: fix memory leak in wl1251_tx_work5.5 Medium
- linux, linux kernel +1 morescsi: smartpqi: Use is_kdump_kernel() to check for kdump7.8 High
- Show moreLoading…