CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- mauticPredictable Page Indexing Might Lead to Sensitive Data Exposure6.5 Medium
- dell powerstore, powerstoreos +1 moreDell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in...6.5 Medium
- chrome-php chromeChrome PHP is missing encoding in `CssSelector`5.3 Medium
- ibm sterling secure proxyIBM Sterling Secure Proxy directory traversal4.3 Medium
- ibm sterling secure proxyIBM Sterling Secure Proxy information disclosure5.9 Medium
broadinstitute/cromwellGitHub ActionsCromwell GitHub Actions Secrets exfiltration via `Issue_comment`9.1 Critical- ibm tivoli monitoringIBM Tivoli Monitoring code execution9.8 Critical
- edgelesssys contrastContrast before 1.8.1 Information Disclosure via Logging8.5 High
- valtimo-platform valtimo-backend-librariesValtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users8.3 High
- traefikTraefik allows path traversal using url encoding2.9 Low
- avast business antivirusLack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files7.3 High
- apache commons beanutils, apache software foundation commons beanutils 1.x, commons beanutils 2.x +2 moreApache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default8.8 High
- real easy store easy storeReflected Cross Site Scripting (XSS) in Real Easy Store5.1 Medium
- alexei-led aws-mcp-serveraws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that...9.4 Critical
- devolutions serverImproper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user...6.5 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System user_order_customer_update.php unrestricted upload6.9 Medium
- campcodes online hospital management systemCampcodes Online Hospital Management System betweendates-detailsreports.php sql injection6.9 Medium
- sourcecodester computer store system, razormist simple computer store system +1 moreSourceCodester Computer Store System main.c Add stack-based overflow4.8 Medium
- hackneyConnection pool exhaustion in hackney2.3 Low
- freefloat ftp serverFreeFloat FTP Server PORT Command buffer overflow6.9 Medium
- dinorankMissing Authorization in DinoRANK5.3 Medium
- llamaindex, run-llama run-llama/llama index +1 moreCommand Injection in LLama-Index CLI in run-llama/llama_index7.8 High
- wpextended the ultimate wordpress toolkit – wp extendedWP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- erumfaham likes and dislikes pluginLikes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection7.5 High
- apache inlongApache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read9.1 Critical
- apache inlongApache InLong: JDBC Vulnerability For URLEncode and backspace bypass6.5 Medium
- apache inlongApache InLong: JDBC Vulnerability during verification processing6.5 Medium
- fortinet fortiportalA insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0,...2.2 Low
- fortinet forticlient, forticlientwindows +1 moreA exposure of sensitive system information to an unauthorized control sphere in Fortinet...4.8 Medium
- fortinet fortios, fortiproxy, fortiswitchmanager +2 moreA missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6...9.0 Critical
- fortinet fortiosA integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0...4.8 Medium
- fortinet fortimanagerA missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0...2.1 Low
- fortinet fortiosA buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7...3.4 Low
- fortinet forticlient, forticlientmac +1 moreAn Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0...7.4 High
- marco milesi wp attachmentsWP Attachments <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter6.1 Medium
- evertz 3080ipx-10g, 5782xps-app-4e, 7890ixg +3 more +5 moreUnauthenticated Arbitrary Command Injection in Evertz SDVN9.3 Critical
- curlNo QUIC certificate pinning with wolfSSL4.8 Medium
- curlQUIC certificate check skip with wolfSSL6.5 Medium
- stylemixthemes masterstudy lms proMasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- ibm security guardiumIBM Security Guardium information disclosure4.9 Medium
- ibm security guardiumIBM Security Guardium information disclosure4.3 Medium
- ibm security guardiumIBM Security Guardium information disclosure4.3 Medium
tarantoolOSS-FuzzUNKNOWN WRITE in luaL_newstateNo scorenet-toolsDebiannet-tools - regression updateNo score- smarsh telemessage, telemessage service +1 moreThe TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up...3.2 Low
- smarsh telemessage, telemessage service +1 moreThe TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even...2.8 Low
- smarsh telemessage, telemessage service +1 moreThe TeleMessage service through 2025-05-05 implements authentication through a long-lived...4.0 Medium
- smarsh telemessage, telemessage service, tm sgnl +2 moreThe TeleMessage service through 2025-05-05 is based on a JSP application in which the heap...4.0 Medium
- smarsh telemessage, telemessage service, tm sgnl +2 moreThe TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap...5.3 Medium
- smarsh telemessage, telemessage service +1 moreThe admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover...4.3 Medium
- Show moreLoading…