CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- apache supersetApache Superset: Improper authorization bypass on row level security via SQL Injection7.1 High
- jct airpointerLocal Privilege Escalation7.8 High
- jct airpointerRemote Code Execution6.6 Medium
- jct airpointerLocal File Inclusion4.1 Medium
- jct airpointerDefault Credentials6.5 Medium
- ninjateam chat for telegram, wp telegram chat widget +1 moreNinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter6.4 Medium
- krasenslavov featured image plus, featured image plus – bulk edit featured images, unsplash & alt text manager +1 moreFeatured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update4.3 Medium
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter6.4 Medium
- uchida yoko co., ltd. wivia 5, uchida wivia 5 firmware +1 moreClient-side enforcement of server-side security issue exists in wivia 5 all versions. If...6.9 Medium
- uchida yoko co., ltd. wivia 5, uchida wivia 5 firmware +1 moreCross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user...5.1 Medium
- uchida yoko co., ltd. wivia 5, uchida wivia 5 firmware +1 moreAn OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited,...7.1 High
- freescoutFreeScout Vulnerable to Stored XSS4.6 Medium
- freescoutFreeScout has Race Condition When Deleting Users5.1 Medium
- freescoutFreeScout Vulnerable to Stored XSS4.6 Medium
- freescoutFreeScout Vulnerable to Stored XSS4.6 Medium
- freescoutFreeScout Vulnerable to Stored XSS6.0 Medium
- freescoutFreeScout Vulnerable to Stored XSS6.1 Medium
- freescoutFreeScout Vulnerable to Stored XSS6.1 Medium
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS RCE in Edit component8.6 High
- gearside developer dashboard, unknown gearside developer dashboard +1 moreWordPress Gearside Developer Dashboard <= 1.0.72 - Reflected XSS6.1 Medium
- vmware spring cloud gateway, spring cloud gateway server mvc +1 moreCVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies8.6 High
- crm perks integration for salesforce and contact form 7, wpforms, elementor, formidable, ninja formsIntegration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure5.3 Medium
- gonzomir minimal share buttonsMinimal Share Buttons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter6.4 Medium
- freescoutFreeScout Vulnerable to Stored XSS4.6 Medium
- freescoutFreeScout Stored XSS leads to CSRF6.3 Medium
- freescoutFreeScout Has Business Logic Errors5.3 Medium
- freescoutFreeScout Has Business Logic Errors6.1 Medium
- freescoutFreeScout Has Business Logic Errors7.0 High
- freescoutFreeScout Has Business Logic Errors8.5 High
- freescoutFreeScout Has Business Logic Errors7.0 High
- freescoutFreeScout Has Business Logic Errors7.1 High
- freescoutFreeScout Has Business Logic Errors7.1 High
- aryan6673 project-aiProject AI API Key Exposure in Source Code2.7 Low
- cvat computer vision annotation tool, cvat-ai cvat +1 moreCVAT has information disclosure via browsable API5.3 Medium
- lovableAn insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote...9.3 Critical
- jhead project jheadjhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.7.8 High
- hdfgroup hdf5hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset...8.8 High
- hdfgroup hdf5hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.8.8 High
- tinxy wifi lock controller v1 rf firmwareTinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi...9.1 Critical
- tinxy wifi lock controller v1 rf firmwareTinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including...7.5 High
- tinxy wifi lock controller v1 rf firmwareTinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext,...5.9 Medium
- consilium safety cs5000 fire panelConsilium Safety CS5000 Fire Panel Use of Hard-coded Credentials9.3 Critical
- consilium safety cs5000 fire panelConsilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default9.3 Critical
- instantel micromateInstantel Micromate Missing Authentication for Critical Function9.3 Critical
- gradio-app gradioGradio Allows Unauthorized File Copy via Path Manipulation5.3 Medium
- navidromeNavidrome Transcoding Permission Bypass Vulnerability Report7.4 High
- 1000 projects online notice board1000 Projects Online Notice Board index.php sql injection6.9 Medium
- santesoft dicom viewer pro, sante dicom viewer pro +1 moreSantesoft Sante DICOM Viewer Pro Out-of-bounds Read8.4 High
- pcman ftp serverPCMan FTP Server NLST Command buffer overflow6.9 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in Safari 18.4,...9.8 Critical
- Show moreLoading…