CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- smartbedded meteobridge, meteobridge firmware, meteobridge vm +2 moreArbitrary Command Injection in Smartbedded MeteoBridge8.7 High
- jqlang jqjq has signed integer overflow in jv.c:jvp_array_write4.3 Medium
- kingdee cloud galaxy private cloud bbc systemKingdee Cloud Galaxy Private Cloud BBC System File deleteFileAction.jhtml path traversal5.3 Medium
- progetFormula injection in a CSV file in Proget MDM2.4 Low
- progetXSS in Proget MDM2.4 Low
- progetXSS in Proget MDM2.4 Low
- progetInformation disclosure in Proget MDM5.1 Medium
- progetInformation disclosure in Proget MDM4.6 Medium
- progetPassword disclosure in Proget MDM7.0 High
- echarge hardy barth cph2 / cpp2 charging stationsHard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations6.5 Medium
- echarge hardy barth cph2 / cpp2 charging stationsBackdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations8.1 High
- echarge hardy barth cph2 / cpp2 charging stationsBackdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stations6.2 Medium
- echarge hardy barth cph2 / cpp2 charging stationsHard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations6.5 Medium
- echarge hardy barth cph2 / cpp2 charging stationsHard-coded OS root credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations7.7 High
- echarge hardy barth cph2 / cpp2 charging stationsOS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations6.5 Medium
- echarge hardy barth cph2 / cpp2 charging stationsMissing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations6.5 Medium
- proget konsola proget, proget +1 moreInformation disclosure in Proget MDM5.1 Medium
- spring securityCVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods9.1 Critical
- baswaniyash animated buttonsAnimated Buttons <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- darkyudex dpepressDPEPress <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- measuremarketing wp youtube video optimizerWP YouTube Video Optimizer <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- johnzenausa network posts extendedNetwork Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter6.4 Medium
- wecantrack affiliate sales in google analytics and other toolsAffiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect6.1 Medium
- rilwis slim seo – a fast & automated seo plugin for wordpressSlim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode6.4 Medium
- splititSplitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions5.4 Medium
- steinrein glossary by wppedia – best glossary plugin for wordpressGlossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection7.2 High
- creativefreedomau raisely donation formRaisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode6.4 Medium
- checkmkArbitrary file write with vcrtrace8.7 High
- clickhouse, clickhouse db +1 moreStack overflow leading to DoS can be triggered by a malicious authenticated client.8.2 High
- lenovo browserYandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.6.9 Medium
- yandex browser lite, browser +1 moreYandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.8.3 High
- yandex browser lite, browser +1 moreYandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.8.2 High
- eclipse jgitXXE vulnerability in Eclipse JGit6.8 Medium
- wpstylish madara – responsive and modern wordpress theme for manga sitesMadara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion9.8 Critical
- unitedover digits, unknown digits: wordpress mobile number signup and login +1 moreDigits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c6.5 Medium
- hkcmsHkCms Search index.html cross site scripting5.3 Medium
- moonlightl hexo-bootmoonlightL hexo-boot Dynamic List Page index.html cross site scripting4.8 Medium
- typo3 reint downloadmanager extensionreint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference8.6 High
- nitsantech ns-backup, typo3 ns backup extension +1 moreThe Backup Plus extension for TYPO3 (ns_backup) allows XSS6.1 Medium
- typo3 sr feuser register extensionThe Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference8.6 High
- typo3 ns backup extensionThe Backup Plus extension for TYPO3 (ns_backup) allows command injections6.8 Medium
- typo3 cs seo extension[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability6.4 Medium
- typo3 femanager extensionThe femanager TYPO3 extension allows Insecure Direct Object Reference5.3 Medium
- typo3 ns backup extensionThe Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location8.6 High
- typo3 sr feuser register extensionThe Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution10.0 Critical
- vtiger crmA Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0...6.1 Medium
- seeddmsA stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability...5.4 Medium
- vtiger crmA vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges...7.2 High
- seeddmsA vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary...7.2 High
- Show moreLoading…