Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2025

207 records · 26 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2024-12824
    40Plan

    Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    scriptsbundle · nokri – job board wordpress themeMar 1, 2025

  • CVE-2025-1799
    21Monitor

    Zorlan SkyCaiji Tool.php previewAction server-side request forgery

    MediumCVSS 5.3No exploitEPSS 0%

    skycaiji · skycaijiMar 1, 2025

  • CVE-2025-1829
    25Monitor

    TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection

    MediumCVSS 5.3No exploitEPSS 12%

    totolink · x18 firmwareMar 2, 2025

  • CVE-2025-27590
    47Plan

    In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux us

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    oxidized web project · oxidized webMar 3, 2025

  • CVE-2025-1851
    34Monitor

    Tenda AC7 SetFirewallCfg formSetFirewallCfg stack-based overflow

    HighCVSS 8.7No exploitEPSS 1%

    tenda · ac7 firmwareMar 3, 2025

  • CVE-2024-53027
    30Monitor

    Buffer Copy Without Checking Size of Input in WLAN Host

    HighCVSS 7.5Proof of conceptEPSS 0%

    qualcomm · qca9367 firmwareMar 3, 2025

  • CVE-2025-1868
    27Monitor

    Information display on multiple products from Famatech Corp

    MediumCVSS 6.9Proof of conceptEPSS 0%

    famatech corp · advanced ip scannerMar 3, 2025

  • CVE-2025-0288
    31Monitor

    Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function,

    HighCVSS 7.8Proof of conceptEPSS 0%

    paragon-software · paragon backup \& recoveryMar 3, 2025

  • CVE-2025-27423
    35Monitor

    Improper Input Validation in Vim

    HighCVSS 7.1No exploitEPSS 22%

    vim · vimMar 3, 2025

  • CVE-2023-49031
    20Monitor

    Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to rea

    MediumCVSS 5.1Proof of conceptEPSS 0%

    oneadvanced · tikit emarketingMar 3, 2025

  • CVE-2025-25967
    35Monitor

    Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF).

    HighCVSS 8.8Proof of conceptEPSS 0%

    ddsn · acora cmsMar 3, 2025

  • CVE-2025-26206
    36Monitor

    Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html co

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    selldone · storefrontMar 3, 2025

  • CVE-2024-51962
    34Monitor

    SQL injection vulnerability in ArcGIS Server

    HighCVSS 8.7No exploitEPSS 0%

    esri · arcgis serverMar 3, 2025

  • CVE-2025-1639
    35Monitor

    Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    HighCVSS 8.8Proof of conceptEPSS 1%

    crowdytheme · arolaxMar 4, 2025

  • CVE-2025-1306
    35Monitor

    Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 0%

    spicethemes · newscrunchMar 4, 2025

  • CVE-2025-1307
    40Plan

    Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    spicethemes · newscrunchMar 4, 2025

  • CVE-2024-48248
    92Now

    NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l

    HighCVSS 8.6KEVWeaponizedEPSS 94%

    nakivo · backup \& replication directorMar 4, 2025

  • CVE-2025-0370
    32Monitor

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter

    MediumCVSS 5.4No exploitEPSS 35%

    vanokhin · shortcodes ultimateMar 4, 2025

  • CVE-2025-22224
    62This week

    VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.

    HighCVSS 8.2KEVWeaponizedEPSS 1%

    vmware · esxiMar 4, 2025

  • CVE-2025-22225
    62This week

    VMware ESXi contains an arbitrary write vulnerability.

    HighCVSS 8.2KEVWeaponizedEPSS 1%

    vmware · esxiMar 4, 2025

  • CVE-2025-22226
    55Plan

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.

    MediumCVSS 6.0KEVWeaponizedEPSS 1%

    vmware · esxiMar 4, 2025

  • CVE-2024-10930
    28Monitor

    Carrier Block Load Privilege Escalation

    HighCVSS 7.1Proof of conceptEPSS 0%

    carrier · block loadMar 4, 2025

  • CVE-2025-26202
    17Monitor

    Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in

    MediumCVSS 4.3Proof of conceptEPSS 0%

    Mar 4, 2025

  • CVE-2025-26318
    23Monitor

    hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected

    MediumCVSS 5.8Proof of conceptEPSS 0%

    tsplus · tsplus remote accessMar 4, 2025

  • CVE-2025-1316
    89Now

    Edimax IC-7100 IP Camera OS Command Injection

    CriticalCVSS 9.3KEVWeaponizedEPSS 74%

    edimax · ic-7100 firmwareMar 4, 2025

  • CVE-2025-26319
    56Plan

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    CriticalCVSS 9.8Proof of conceptEPSS 55%

    flowiseai · flowiseMar 4, 2025

  • CVE-2024-8682
    21Monitor

    JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration

    MediumCVSS 5.3Proof of conceptEPSS 0%

    https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392 · jnews - wordpress newspaper magazine blog amp themeMar 5, 2025

  • CVE-2024-48246
    21Monitor

    Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/book

    MediumCVSS 5.4Proof of conceptEPSS 0%

    janobe · vehicle management systemMar 5, 2025

  • CVE-2025-27515
    27Monitor

    Laravel has a File Validation Bypass

    MediumCVSS 6.9Proof of conceptEPSS 0%

    laravel · frameworkMar 5, 2025

  • CVE-2025-27506
    24Monitor

    NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

    MediumCVSS 6.1Proof of conceptEPSS 0%

    nocodb · nocodbMar 6, 2025

  • CVE-2024-57972
    27Monitor

    The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) t

    MediumCVSS 6.5Proof of conceptEPSS 2%

    microsoft · hololensMar 6, 2025

  • CVE-2025-25763
    39Monitor

    crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    crmeb · crmebMar 6, 2025

  • CVE-2024-9458
    19Monitor

    Reservit Hotel < 3.0 - Admin+ Stored XSS

    MediumCVSS 4.8Proof of conceptEPSS 0%

    reservit · reservit hotelMar 7, 2025

  • CVE-2025-25617
    17Monitor

    Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.

    MediumCVSS 4.3Proof of conceptEPSS 0%

    Mar 7, 2025

  • CVE-2025-27152
    30Monitor

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    HighCVSS 7.7Proof of conceptEPSS 0%

    axios · axiosMar 7, 2025

  • CVE-2025-27519
    37Monitor

    Cognita Arbitrary File Write

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    truefoundry · cognitaMar 7, 2025

  • CVE-2025-27607
    35Monitor

    Python JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependency

    HighCVSS 8.8Proof of conceptEPSS 1%

    nhairs · python json loggerMar 7, 2025

  • CVE-2025-2094
    25Monitor

    TOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig os command injection

    MediumCVSS 5.3No exploitEPSS 12%

    totolink · ex1800t firmwareMar 7, 2025

  • CVE-2025-1323
    40Plan

    WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    plechevandrey · wp-recallMar 8, 2025

  • CVE-2025-27840
    27Monitor

    Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).

    MediumCVSS 6.8Proof of conceptEPSS 1%

    espressif · esp32 firmwareMar 8, 2025

  • CVE-2025-27636
    51Plan

    Apache Camel: Camel Message Header Injection via Improper Filtering

    MediumCVSS 5.6Proof of conceptEPSS 97%

    apache · camelMar 9, 2025

  • CVE-2025-2126
    24Monitor

    JoomlaUX JUX Real Estate GET Parameter realties sql injection

    MediumCVSS 5.3Proof of conceptEPSS 11%

    joomlaux · jux real estateMar 9, 2025

  • CVE-2025-2127
    21Monitor

    JoomlaUX JUX Real Estate realties cross site scripting

    MediumCVSS 5.3Proof of conceptEPSS 0%

    joomlaux · jux real estateMar 9, 2025

  • CVE-2025-2129
    25Monitor

    Mage AI insecure default initialization of resource

    MediumCVSS 6.3Proof of conceptEPSS 1%

    Mar 9, 2025

  • CVE-2025-25615
    10Monitor

    Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.

    LowCVSS 2.7Proof of conceptEPSS 0%

    changeweb · unifiedtransformMar 10, 2025

  • CVE-2025-25616
    17Monitor

    Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams.

    MediumCVSS 4.3Proof of conceptEPSS 0%

    changeweb · unifiedtransformMar 10, 2025

  • CVE-2025-26865
    14Monitor

    Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

    LowCVSS 3.5Proof of conceptEPSS 0%

    apache · ofbizMar 10, 2025

  • CVE-2025-25614
    35Monitor

    Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow

    HighCVSS 8.8Proof of conceptEPSS 0%

    changeweb · unifiedtransformMar 10, 2025

  • CVE-2025-25620
    21Monitor

    Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    changeweb · unifiedtransformMar 10, 2025

  • CVE-2025-24813
    99Now

    Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · tomcatMar 10, 2025

  • CVE-2025-27136
    22Monitor

    LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    robothy · local-s3Mar 10, 2025

  • CVE-2025-2135
    37Monitor

    Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8Proof of conceptEPSS 6%

    google · chromeMar 10, 2025

  • CVE-2025-1661
    56Plan

    HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    pluginus · husky - products filter professional for woocommerceMar 11, 2025

  • CVE-2024-13853
    24Monitor

    SEO Tools <= 4.0.7 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    zynit · seo toolsMar 11, 2025

  • CVE-2025-2190
    32Monitor

    The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.

    HighCVSS 8.1No exploitEPSS 0%

    tecno · com.transsnet.storeMar 11, 2025

  • CVE-2025-1550
    30Monitor

    Arbitrary Code Execution via Crafted Keras Config for Model Loading

    HighCVSS 7.3Proof of conceptEPSS 2%

    keras · kerasMar 11, 2025

  • CVE-2025-27893
    17Monitor

    In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such a

    MediumCVSS 4.3Proof of conceptEPSS 0%

    archerirm · archerMar 11, 2025

  • CVE-2024-54085
    88Now

    Redfish Authentication Bypass

    CriticalCVSS 10.0KEVWeaponizedEPSS 60%

    ami · megarac sp-xMar 11, 2025

  • CVE-2025-27363
    70This week

    An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse

    HighCVSS 8.1KEVWeaponizedEPSS 27%

    freetype · freetypeMar 11, 2025

  • CVE-2024-54018
    31Monitor

    Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a pr

    HighCVSS 7.2No exploitEPSS 10%

    fortinet · fortisandboxMar 11, 2025

  • CVE-2025-25747
    21Monitor

    Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive info

    MediumCVSS 5.4Proof of conceptEPSS 0%

    digitaldruid · hoteldruidMar 11, 2025

  • CVE-2025-24035
    33Monitor

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 1%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24054
    70This week

    NTLM Hash Disclosure Spoofing Vulnerability

    MediumCVSS 5.4KEVWeaponizedEPSS 62%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24071
    33Monitor

    Microsoft Windows File Explorer Spoofing Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 23%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24076
    30Monitor

    Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

    HighCVSS 7.3Proof of conceptEPSS 3%

    microsoft · windows 11 22h2Mar 11, 2025

  • CVE-2025-24983
    58Plan

    Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 1%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24984
    49Plan

    Windows NTFS Information Disclosure Vulnerability

    MediumCVSS 4.6KEVWeaponizedEPSS 1%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24985
    62This week

    Windows Fast FAT File System Driver Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24991
    53Plan

    Windows NTFS Information Disclosure Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-24993
    62This week

    Windows NTFS Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2025-26633
    67This week

    Microsoft Management Console Security Feature Bypass Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 30%

    microsoft · windows 10 1507Mar 11, 2025

  • CVE-2021-37787
    26Monitor

    The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POS

    MediumCVSS 6.5Proof of conceptEPSS 0%

    abocms · abo.cmsMar 11, 2025

  • CVE-2025-24201
    71This week

    An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.

    CriticalCVSS 10.0KEVWeaponizedEPSS 3%

    apple · safariMar 11, 2025

  • CVE-2025-25748
    29Monitor

    A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifyi

    HighCVSS 7.3Proof of conceptEPSS 0%

    digitaldruid · hoteldruidMar 11, 2025

  • CVE-2025-25749
    28Monitor

    An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength poli

    HighCVSS 7.1Proof of conceptEPSS 0%

    digitaldruid · hoteldruidMar 11, 2025

  • CVE-2025-27591
    27Monitor

    A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/

    MediumCVSS 6.8Proof of conceptEPSS 0%

    facebook · belowMar 11, 2025

  • CVE-2025-28906
    23Monitor

    WordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9Proof of conceptEPSS 0%

    thiago s.f. · skitter slideshowMar 11, 2025

  • CVE-2025-28915
    36Monitor

    WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    theme egg · themeegg toolkitMar 11, 2025

  • CVE-2025-22954
    48Plan

    GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or

    CriticalCVSS 10.0Proof of conceptEPSS 25%

    koha · kohaMar 12, 2025

  • CVE-2025-27915
    52Plan

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.

    MediumCVSS 5.4KEVWeaponizedEPSS 4%

    synacor · zimbra collaboration suiteMar 12, 2025

  • CVE-2025-29891
    42Plan

    Apache Camel: Camel Message Header Injection through request parameters

    MediumCVSS 4.8No exploitEPSS 76%

    apache · camelMar 12, 2025

  • CVE-2025-20115
    34Monitor

    Cisco IOS XR Software Border Gateway Protocol Denial of Service Vulnerability

    HighCVSS 8.6Proof of conceptEPSS 0%

    cisco · ios xrMar 12, 2025

  • CVE-2025-21590
    57Plan

    Junos OS: An local attacker with shell access can execute arbitrary code

    MediumCVSS 6.7KEVWeaponizedEPSS 1%

    juniper · junosMar 12, 2025

  • CVE-2025-0117
    28Monitor

    GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    palo alto networks · globalprotect appMar 12, 2025

  • CVE-2025-22870
    17Monitor

    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

    MediumCVSS 4.4Proof of conceptEPSS 0%

    go standard library · net/httpMar 12, 2025

  • CVE-2025-27407
    37Monitor

    Remote code execution when loading a crafted GraphQL schema

    CriticalCVSS 9.0Proof of conceptEPSS 3%

    rmosolgo · graphql-rubyMar 12, 2025

  • CVE-2025-25291
    43Plan

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    omniauth · omniauth samlMar 12, 2025

  • CVE-2025-25292
    57Plan

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    CriticalCVSS 9.3No exploitEPSS 65%

    omniauth · omniauth samlMar 12, 2025

  • CVE-2025-2264
    60This week

    Santesoft Sante PACS Server Path Traversal Information Disclosure

    HighCVSS 7.5WeaponizedEPSS 35%

    santesoft · sante pacs serverMar 13, 2025

  • CVE-2024-55060
    24Monitor

    A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web s

    MediumCVSS 6.1Proof of conceptEPSS 0%

    rafed-system · rafed cms websiteMar 13, 2025

  • CVE-2025-2221
    31Monitor

    WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 1%

    wpcom · wpcom memberMar 14, 2025

  • CVE-2024-8176
    30Monitor

    Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

    HighCVSS 7.5Proof of conceptEPSS 1%

    red hat · red hat enterprise linux 10Mar 14, 2025

  • CVE-2025-2304
    37Monitor

    Camaleon CMS Privilege Escalation

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    owen2345 · camaleon-cmsMar 14, 2025

  • CVE-2023-33300
    25Monitor

    A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earl

    MediumCVSS 5.3No exploitEPSS 13%

    fortinet · fortinacMar 14, 2025

  • CVE-2025-29384
    40Plan

    In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    tenda · ac9 firmwareMar 14, 2025

  • CVE-2025-29774
    40Plan

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    CriticalCVSS 9.3Proof of conceptEPSS 9%

    node-saml · xml-cryptoMar 14, 2025

  • CVE-2025-29775
    40Plan

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    CriticalCVSS 9.3Proof of conceptEPSS 9%

    node-saml · xml-cryptoMar 14, 2025

  • CVE-2023-52927
    31Monitor

    netfilter: allow exp not to be removed in nf_ct_find_expectation

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMar 14, 2025

  • CVE-2025-30066
    86Now

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.

    HighCVSS 8.6KEVWeaponizedEPSS 72%

    tj-actions · changed-filesMar 15, 2025

  • CVE-2024-13126
    18Monitor

    Download Manager < 3.3.07 - Unauthenticated Data Exposure

    MediumCVSS 4.6Proof of conceptEPSS 0%

    w3eden · download managerMar 16, 2025