CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- apple macosA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in...5.5 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreA logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and...5.5 Medium
- apple macosAn authentication issue was addressed with improved state management. This issue is fixed in...4.6 Medium
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4....9.1 Critical
- apple macosA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS...8.2 High
- freefloat ftp serverFreeFloat FTP Server RETR Command buffer overflow6.9 Medium
- chshcms mccmschshcms mccms Backups.php restore_del path traversal5.3 Medium
- chshcms mccmschshcms mccms Gf.php index server-side request forgery5.3 Medium
- zhilink adp application developer platform, zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台 +1 morezhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 verifyToken deserialization5.3 Medium
- esri portal for arcgisServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS9.1 Critical
- zhilink adp application developer platform, zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台 +1 morezhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine5.3 Medium
- discourse discourse-policyDiscourse Policy plugin private group members visible3.5 Low
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service6.5 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- apache tomcatApache Tomcat: Security constraint bypass for CGI scripts7.3 High
- thimpress course builderWordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability9.8 Critical
- dell thinosDell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A...5.7 Medium
- techpowerup gpu-zTechPowerUp GPU-Z 0x8000645C IOCTL GPU-Z.sys sub_140001880 memory leak4.8 Medium
- fossasia open-event-serverfossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checking6.3 Medium
- openmrs openmrs-module-fhir2OpenMRS has Vulnerability in FHIR2 Module Privileges8.0 High
- navidromeNavidrome allows SQL Injection via role parameter8.9 High
- phpoffice mathPHPOffice Math allows XXE when processing an XML file in the MathML format8.7 High
- fabiolb fabioFabio allows HTTP clients to manipulate custom headers it adds9.1 Critical
- freescoutFreeScout Vulnerable to Insufficient Authorization5.3 Medium
- freescoutFreeScout Vulnerable to Insufficient Authorization5.3 Medium
- freescoutFreeScout Vulnerable to Insufficient Authorization5.3 Medium
- freescoutFreeScout Vulnerable to Insufficient Authorization6.9 Medium
- freescoutFreeScout Vulnerable to Arbitrary File Upload7.0 High
- freescoutFreeScout Vulnerable to Remote Code Execution (RCE)8.6 High
- freescoutFreeScout Vulnerable to Deserialization of Untrusted Data8.6 High
- mattermost, mattermost server +1 moreTeam Privacy Settings Authorization Bypass in Mattermost Server5.3 Medium
- aimhubio aimaimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation5.3 Medium
- devolutions remote desktop managerExposure of private personal information to an unauthorized actor in the user vaults component of...7.5 High
- blackmagic design davinci resolveTCC Bypass via Dylib Substitution in DaVinci Resolve4.8 Medium
- ami aptiov, aptio v +1 moreSMM buffer Integrity5.8 Medium
brlttySUSESecurity update for brlttyNo score- gradio-app gradiogradio-app gradio CORS is_valid_origin privilege escalation6.3 Medium
- linux, linux kernel +1 morefs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()5.5 Medium
- debian linux, linux kernel +1 moreopenvswitch: Fix unsafe attribute parsing in output_userspace()7.8 High
- debian linux, linux kernel +1 morenetfilter: ipset: fix region locking in hash types7.8 High
- linux, linux kernel +1 moreKVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()8.8 High
- debian linux, linux kernel +1 moremodule: ensure that kobject_put() is safe for module type kobjects5.5 Medium
- debian linux, linux kernel +1 moreusb: typec: ucsi: displayport: Fix NULL pointer access5.5 Medium
- linux, linux kernel +1 morecan: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe5.5 Medium
- mici network co. ltd. netfax serverMICI Network Co. Ltd. NetFax Server Command Injection9.4 Critical
- mici network co. ltd. netfax serverMICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext5.3 Medium
- mici network co. ltd. netfax serverMICI Network Co. Ltd. NetFax Server Default Administrator Credentials Disclosure8.7 High
- Show moreLoading…