CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- lenovo pc manager, pcmanager +1 moreAn improper default permissions vulnerability was reported in Lenovo PC Manager that could allow...8.5 High
- lenovo pc manager, pcmanager +1 moreAn untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local...8.5 High
- lenovo legion space for legion go, legion space for legion pc +1 moreAn open debug interface was reported in the Legion Space software included on certain Legion...4.8 Medium
- xwikisas application-urlshortenerapplication-urlshortener users can create arbitrary pages as long as they have view access to them5.7 Medium
- campcodes online hospital management systemCampcodes Online Hospital Management System appointment-history.php sql injection6.9 Medium
linux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +16 more +18 moreUpdate of linux-firmwareNo scorelessTuxCareUpdate of lessNo scorelinux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +14 more +16 moreUpdate of linux-firmwareNo scorelinux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +18 more +20 moreUpdate of linux-firmwareNo score- campcodes cyber cafe management systemPHPGurukul/Campcodes Cyber Cafe Management System bwdates-reports-details.php sql injection6.9 Medium
linux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +18 more +20 moreUpdate of linux-firmwareNo score- freefloat ftp serverFreeFloat FTP Server PWD Command buffer overflow6.9 Medium
- lenovo browserA use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.6827.4 High
linux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +21 more +23 moreUpdate of linux-firmwareNo score- freefloat ftp serverFreeFloat FTP Server BYE Command buffer overflow6.9 Medium
- hcl software traveler for microsoft outlook (htmo), hcltech traveler for microsoft outlook +1 moreHCL Traveler for Microsoft Outlook (HTMO) is susceptible to COM hijacking6.5 Medium
- hcl software traveler for microsoft outlook (htmo), hcltech traveler for microsoft outlook +1 moreHCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking6.5 Medium
- hcl software glovius cloudHCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerability6.8 Medium
- cli go-ghPrevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server2.6 Low
- kruger&matz com.pri.applockIntent Injection in Kruger&Matz AppLock application8.3 High
- kruger&matz com.pri.applockExposure of Applications' Encryption PINs in Kruger&Matz AppLock6.9 Medium
- kruger&matz com.pri.factorytestUnrestricted Access to Exported Service in com.pri.factorytest6.9 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup4.3 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 morePrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw4.2 Medium
- mattermost, mattermost server +1 moreImproper Access Control in Mattermost allows System Managers to view team details despite role restrictions3.1 Low
- mattermost, mattermost server +1 moreBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server5.4 Medium
- mattermost, mattermost server +1 moreGoogle OAuth Authentication Bypass for Converted Bot Accounts4.2 Medium
- mattermost, mattermost server +1 moreImproper Access Control in Mattermost Channel Member API3.1 Low
- dassault systèmes collaborative industry innovatorStored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes city referential managerStored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes city referential managerStored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes project portfolio managerStored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes product managerStored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes multidisciplinary optimization engineerStored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.7 High
- dassault systèmes product managerStored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes product managerStored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes collaborative industry innovatorStored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x8.7 High
- dassault systèmes service process engineerStored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x8.7 High
- vanquish woocommerce orders & customers exporterWordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability7.5 High
- hitachi energy asset suiteA vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If...9.1 Critical
- hitachi energy asset suiteA vulnerability exists in the media upload component of the Asset Suite versions listed below....6.3 Medium
- perlPerl threads have a working directory race condition where file operations may target unintended paths5.9 Medium
- devolutions serverImproper access control in user group management in Devolutions Server 2025.1.7.0 and earlier...8.7 High
- sorich87 browse asBrowse As <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie8.8 High
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets6.4 Medium
- bc2018 woo slider pro – drag drop slider builder for woocommerceWoo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion6.5 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- opensheetmusicdisplayOpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter6.4 Medium
- plugins and snippets simple page access restrictionSimple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters6.5 Medium
- binarycarpenter woo slider proWordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability6.5 Medium
- Show moreLoading…