CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- freescoutFreeScout Has Insufficient Protection Against CRLF-injection7.0 High
- redisredis-check-aof may lead to stack overflow and potential RCE4.7 Medium
- teltonika networks rmsAccount pre-hijacking through invite misuse7.2 High
- boldthemes bold page builderBold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter6.4 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode6.4 Medium
- goiblas map block leafletMap Block Leaflet <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter6.4 Medium
mcp-markdownify-servernpmMarkdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function8.2 Highmcp-markdownify-servernpmMarkdownify MCP Server allows attackers to read arbitrary files8.2 High- mitsubishi electric corporation melsec iq-f series fx5s-30mr/ds, melsec iq-f series fx5s-30mr/es, melsec iq-f series fx5s-30mt/ds +72 more +74 moreInformation Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU module9.1 Critical
- smub smash balloon social photo feed – easy social feeds plugin, https://profiles.wordpress.org/smub/ smash balloon instagram feed pro +1 moreSmash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute5.4 Medium
- canonical apport, ubuntu linux +1 moreRace Condition in Canonical Apport4.7 Medium
- netwrix directory managerNetwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded...10.0 Critical
- huocmsHuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass...5.3 Medium
- huocmsHuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of...5.3 Medium
- debian linux, linux kernel, systemd project systemd +14 more +16 moreSystemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump4.7 Medium
- maccmsmaccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.7.3 High
- free5gcBuffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of...5.4 Medium
- mikrotik routerosMikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote,...7.5 High
- opennetworking onosAn issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service ...5.6 Medium
- No product listedAn issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via...8.8 High
- broadcom tcpreplaytcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.7.5 High
- yasm project yasmyasm commit 9defefae was discovered to contain a NULL pointer dereference via the...4.8 Medium
- opennetworking onosAn issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses...9.8 Critical
net-toolsUbuntunet-tools regressionNo score- vercel next.jsInformation exposure in Next.js dev server due to lack of origin verification2.3 Low
multicastPyPImulticast in source builds from vulnerable setuptools dependency5.9 Medium- absolute secure accessCross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.544.6 Medium
- absolute secure accessPrivilege escalation in the management console of Absolute Secure Access prior to version 13.547.0 High
- absolute secure accessPermissions bypass in the management console of Absolute Secure Access prior to version 13.546.9 Medium
- vllmvLLM Tool Schema allows DoS via Malformed pattern and type Fields6.5 Medium
- vllmvLLM allows clients to crash the openai server with invalid regex6.5 Medium
- vllmvLLM DOS: Remotely kill vllm over http with invalid JSON schema6.5 Medium
- vllmvLLM has a Weakness in MultiModalHasher Image Hashing Implementation4.2 Medium
- vllmvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel2.6 Low
- vllmvllm - Regular Expression Denial of Service in Multiple Components5.3 Medium
- vllmvLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`6.5 Medium
- drupal cookies consent managementCOOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0768.6 High
- drupal cookies consent managementCOOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0758.6 High
- drupal etrackeretracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0747.3 High
- 1xinternet simple klaroSimple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0735.0 Medium
- drupal eu cookie compliance (gdpr compliance), freelance-it-consultant eu cookie compliance +1 moreEU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0725.0 Medium
- 1xinternet simple klaroSimple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-0718.8 High
- drupal bookable calendarBookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-0706.5 Medium
- mauticOpen Redirect vulnerability on user unlock path5.4 Medium
- zitadelZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection8.1 High
- argoproj argo cd, argo-cd +1 moreArgo CD allows cross-site scripting on repositories page9.1 Critical
- acquia mauticSegment cloning doesn't have a proper permission check4.3 Medium
vuetifyTuxCare,@vuetify/api-generatorTuxCare +1 moreVuetify XSS through 'eventMoreText' prop of VCalendar5.6 Medium- mauticUser name enumeration possible due to response time difference on password reset form5.3 Medium
- mauticMautic does not shield .env files from web traffic5.1 Medium
- Show moreLoading…