Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2025

186 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2025-30911
    40Plan

    WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    rometheme · rtmkitApr 1, 2025

  • CVE-2025-30065
    53Plan

    Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

    CriticalCVSS 10.0Proof of conceptEPSS 43%

    apache · parquet javaApr 1, 2025

  • CVE-2024-56325
    63This week

    Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    apache · pinotApr 1, 2025

  • CVE-2025-30676
    44Plan

    Apache OFBiz: Stored XSS Vulnerability

    MediumCVSS 6.1No exploitEPSS 67%

    apache · ofbizApr 1, 2025

  • CVE-2025-31121
    33Monitor

    OpenEMR allows XSS in Patient Image feature

    HighCVSS 7.0No exploitEPSS 17%

    open-emr · openemrApr 1, 2025

  • CVE-2025-31131
    32Monitor

    Path Traversal allowing arbitrary read of files in Yeswiki

    HighCVSS 7.5Proof of conceptEPSS 5%

    yeswiki · yeswikiApr 1, 2025

  • CVE-2025-31864
    23Monitor

    WordPress Beam me up Scotty – Back to Top Button plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.9Proof of conceptEPSS 0%

    out the box · beam me up scottyApr 1, 2025

  • CVE-2025-26054
    21Monitor

    Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Apr 1, 2025

  • CVE-2025-26055
    26Monitor

    An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter o

    MediumCVSS 6.5Proof of conceptEPSS 1%

    Apr 1, 2025

  • CVE-2025-26056
    21Monitor

    A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality.

    MediumCVSS 5.4Proof of conceptEPSS 1%

    Apr 1, 2025

  • CVE-2025-31137
    30Monitor

    Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

    HighCVSS 7.5Proof of conceptEPSS 1%

    remix-run · react-routerApr 1, 2025

  • CVE-2025-3096
    37Monitor

    Clinics Patient Management System SQL Injection

    CriticalCVSS 9.3WeaponizedEPSS 1%

    sourcecodester · clinic's patient management systemApr 1, 2025

  • CVE-2003-20001
    22Monitor

    An issue was discovered on Mitel ICP VoIP 3100 devices.

    MediumCVSS 5.6Proof of conceptEPSS 1%

    Apr 1, 2025

  • CVE-2023-46988
    26Monitor

    Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating th

    MediumCVSS 6.7Proof of conceptEPSS 0%

    onlyoffice · document serverApr 1, 2025

  • CVE-2024-36465
    46Plan

    SQL injection in Zabbix API

    HighCVSS 8.6No exploitEPSS 39%

    zabbix · zabbixApr 2, 2025

  • CVE-2025-2005
    46Plan

    Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    etoilewebdesign · front end usersApr 2, 2025

  • CVE-2025-31722
    35Monitor

    In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attacker

    HighCVSS 8.8Proof of conceptEPSS 1%

    jenkins · templating engineApr 2, 2025

  • CVE-2025-29085
    48Plan

    SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/e

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    Apr 2, 2025

  • CVE-2025-2945
    52Plan

    pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

    HighCVSS 8.8WeaponizedEPSS 56%

    pgadmin · pgadmin 4Apr 3, 2025

  • CVE-2025-31800
    26Monitor

    WordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 0%

    publitio · publitioApr 3, 2025

  • CVE-2025-3155
    33Monitor

    Yelp: arbitrary file read

    HighCVSS 7.4No exploitEPSS 13%

    gnome · yelpApr 3, 2025

  • CVE-2025-22457
    99Now

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ivanti · connect secureApr 3, 2025

  • CVE-2025-31486
    33Monitor

    Vite allows server.fs.deny to be bypassed with .svg or relative paths

    MediumCVSS 5.3Proof of conceptEPSS 40%

    vitejs · viteApr 3, 2025

  • CVE-2025-30406
    97Now

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    gladinet · centrestackApr 3, 2025

  • CVE-2025-31161
    99Now

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy insta

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    crushftp · crushftpApr 3, 2025

  • CVE-2025-31489
    35Monitor

    MinIO performs incomplete signature validation for unsigned-trailer uploads

    HighCVSS 8.7Proof of conceptEPSS 2%

    minio · minioApr 3, 2025

  • CVE-2025-2075
    36Monitor

    Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 2%

    uncannyowl · uncanny automatorApr 4, 2025

  • CVE-2025-3194
    30Monitor

    Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function.

    HighCVSS 7.7Proof of conceptEPSS 0%

    Apr 4, 2025

  • CVE-2025-3243
    21Monitor

    code-projects Patient Record Management System dental_form.php sql injection

    MediumCVSS 5.3Proof of conceptEPSS 0%

    code-projects · patient record management systemApr 4, 2025

  • CVE-2025-28146
    42Plan

    Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url i

    CriticalCVSS 9.8No exploitEPSS 11%

    edimax · br-6478ac v3 firmwareApr 4, 2025

  • CVE-2025-27520
    51Plan

    BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

    CriticalCVSS 9.8WeaponizedEPSS 40%

    bentoml · bentomlApr 4, 2025

  • CVE-2025-32118
    36Monitor

    WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    niteothemes · cmp – coming soon & maintenanceApr 4, 2025

  • CVE-2025-32257
    21Monitor

    WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 0%

    1clickmigration · 1 click wordpress migrationApr 4, 2025

  • CVE-2021-47667
    51Plan

    An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attacke

    CriticalCVSS 10.0No exploitEPSS 36%

    zend · zendtoApr 5, 2025

  • CVE-2025-30401
    32Monitor

    A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file

    MediumCVSS 6.7No exploitEPSS 20%

    whatsapp · whatsappApr 5, 2025

  • CVE-2025-32370
    39Monitor

    Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    kentico · xperienceApr 6, 2025

  • CVE-2025-32013
    37Monitor

    Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    lnbits · lnbitsApr 6, 2025

  • CVE-2025-3248
    99Now

    Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    langflow · langflowApr 7, 2025

  • CVE-2025-2807
    35Monitor

    Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

    HighCVSS 8.8Proof of conceptEPSS 0%

    stylemixthemes · motors - car dealer\, classifieds \& listingApr 8, 2025

  • CVE-2025-2568
    21Monitor

    Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update

    MediumCVSS 5.3Proof of conceptEPSS 0%

    themehunk · vayu blocks – gutenberg blocks for wordpress & woocommerceApr 8, 2025

  • CVE-2024-46671
    28Monitor

    An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below,

    HighCVSS 7.2Proof of conceptEPSS 0%

    fortinet · fortiwebApr 8, 2025

  • CVE-2025-25254
    33Monitor

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below

    HighCVSS 7.2No exploitEPSS 17%

    fortinet · fortiwebApr 8, 2025

  • CVE-2024-48887
    44Plan

    A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin password

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    fortinet · fortiswitchApr 8, 2025

  • CVE-2025-25227
    30Monitor

    [20250402] - Joomla Core - MFA Authentication Bypass

    HighCVSS 7.5Proof of conceptEPSS 0%

    joomla · joomla\!Apr 8, 2025

  • CVE-2025-21204
    33Monitor

    Windows Process Activation Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 6%

    microsoft · windows 10 1507Apr 8, 2025

  • CVE-2025-26670
    35Monitor

    Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 11%

    microsoft · windows 10 1507Apr 8, 2025

  • CVE-2025-26686
    30Monitor

    Windows TCP/IP Remote Code Execution Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    microsoft · windows 10 1507Apr 8, 2025

  • CVE-2025-27480
    36Monitor

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 12%

    microsoft · windows server 2012Apr 8, 2025

  • CVE-2025-27751
    32Monitor

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 2%

    microsoft · 365 appsApr 8, 2025

  • CVE-2025-29793
    35Monitor

    Microsoft SharePoint Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 23%

    microsoft · sharepoint enterprise serverApr 8, 2025

  • CVE-2025-29810
    31Monitor

    Active Directory Domain Services Elevation of Privilege Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 2%

    microsoft · windows 10 1507Apr 8, 2025

  • CVE-2025-29824
    65This week

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 13%

    microsoft · windows 10 1507Apr 8, 2025

  • CVE-2025-30281
    43Plan

    ColdFusion | Improper Access Control (CWE-284)

    CriticalCVSS 9.1No exploitEPSS 23%

    adobe · coldfusionApr 8, 2025

  • CVE-2025-30285
    42Plan

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    HighCVSS 8.4No exploitEPSS 30%

    adobe · coldfusionApr 8, 2025

  • CVE-2025-30290
    40Plan

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    HighCVSS 8.7No exploitEPSS 19%

    adobe · coldfusionApr 8, 2025

  • CVE-2025-30292
    29Monitor

    ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

    MediumCVSS 6.1No exploitEPSS 15%

    adobe · coldfusionApr 8, 2025

  • CVE-2025-30294
    32Monitor

    ColdFusion | Improper Input Validation (CWE-20)

    MediumCVSS 6.8No exploitEPSS 17%

    adobe · coldfusionApr 8, 2025

  • CVE-2025-32375
    55Plan

    Insecure Deserialization leads to RCE in BentoML's runner server

    CriticalCVSS 9.8WeaponizedEPSS 52%

    bentoml · bentomlApr 9, 2025

  • CVE-2025-31033
    39Monitor

    WordPress Buddypress Humanity plugin <= 1.2 - CSRF to Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    adam nowak · buddypress humanityApr 9, 2025

  • CVE-2025-32641
    38Monitor

    WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    anantaddons · anant addons for elementorApr 9, 2025

  • CVE-2025-29018
    19Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking Syst

    MediumCVSS 4.8Proof of conceptEPSS 0%

    codeastro · internet banking systemApr 9, 2025

  • CVE-2024-58136
    95Now

    Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    yiiframework · yiiApr 9, 2025

  • CVE-2025-3102
    55Plan

    SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

    HighCVSS 8.1WeaponizedEPSS 76%

    brainstormforce · ottokit: all-in-one automation platformApr 10, 2025

  • CVE-2025-32140
    39Monitor

    WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    nirmal kumar ram · wp remote thumbnailApr 10, 2025

  • CVE-2025-32206
    36Monitor

    WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    labcat · processing projectsApr 10, 2025

  • CVE-2025-32259
    21Monitor

    WordPress WP ULike plugin <= 4.7.9.1 - Content Spoofing Vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 0%

    alimir · wp ulikeApr 10, 2025

  • CVE-2025-29017
    35Monitor

    A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the

    HighCVSS 8.8Proof of conceptEPSS 0%

    codeastro · internet banking systemApr 10, 2025

  • CVE-2025-32395
    25Monitor

    Vite has an `server.fs.deny` bypass with an invalid `request-target`

    MediumCVSS 6.0Proof of conceptEPSS 1%

    vitejs · viteApr 10, 2025

  • CVE-2025-2636
    35Monitor

    InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion

    HighCVSS 8.1Proof of conceptEPSS 10%

    instawp · instawp connect – 1-click wp staging & migrationApr 11, 2025

  • CVE-2025-32579
    39Monitor

    WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    softclever limited · sync postsApr 11, 2025

  • CVE-2025-32614
    36Monitor

    WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    ashan perera · eventonApr 11, 2025

  • CVE-2025-3538
    38Monitor

    D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow

    HighCVSS 8.7No exploitEPSS 13%

    dlink · di-8100 firmwareApr 13, 2025

  • CVE-2025-2563
    47Plan

    User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation

    HighCVSS 8.1WeaponizedEPSS 48%

    wpeverest · user registration \& membershipApr 14, 2025

  • CVE-2025-3568
    20Monitor

    Webkul Krayin CRM SVG File edit cross site scripting

    MediumCVSS 5.1Proof of conceptEPSS 0%

    webkul · krayin crmApr 14, 2025

  • CVE-2025-24797
    39Monitor

    Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    meshtastic · meshtastic firmwareApr 14, 2025

  • CVE-2024-45712
    21Monitor

    SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability

    MediumCVSS 5.4Proof of conceptEPSS 0%

    solarwinds · serv-uApr 15, 2025

  • CVE-2025-32103
    25Monitor

    CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files ac

    MediumCVSS 5.0No exploitEPSS 18%

    crushftp · crushftpApr 15, 2025

  • CVE-2025-28137
    49Plan

    The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg funct

    CriticalCVSS 9.8No exploitEPSS 34%

    totolink · a810r firmwareApr 15, 2025

  • CVE-2024-36842
    29Monitor

    An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Numbe

    HighCVSS 7.3Proof of conceptEPSS 0%

    Apr 15, 2025

  • CVE-2021-27289
    36Monitor

    A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor =

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    Apr 15, 2025

  • CVE-2025-29705
    17Monitor

    code-gen <=2.0.6 is vulnerable to Incorrect Access Control.

    MediumCVSS 4.3Proof of conceptEPSS 0%

    tanghc · code-genApr 15, 2025

  • CVE-2025-1122
    26Monitor

    Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to ga

    MediumCVSS 6.7Proof of conceptEPSS 0%

    google · chromeApr 15, 2025

  • CVE-2025-21574
    26Monitor

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).

    MediumCVSS 6.5Proof of conceptEPSS 1%

    oracle · mysql clusterApr 15, 2025

  • CVE-2025-30712
    32Monitor

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

    HighCVSS 8.1Proof of conceptEPSS 0%

    oracle · vm virtualboxApr 15, 2025

  • CVE-2025-32778
    43Plan

    Web-Check allows command Injection via Unvalidated URL in Screenshot API

    CriticalCVSS 9.3WeaponizedEPSS 19%

    lissy93 · web-checkApr 15, 2025

  • CVE-2025-27892
    31Monitor

    Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.

    MediumCVSS 6.8Proof of conceptEPSS 12%

    shopware · shopwareApr 15, 2025

  • CVE-2025-29471
    35Monitor

    Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into t

    HighCVSS 8.3Proof of conceptEPSS 7%

    nagios · log serverApr 15, 2025

  • CVE-2025-30967
    38Monitor

    WordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    notfound · wpjobboardApr 15, 2025

  • CVE-2025-3663
    30Monitor

    TOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control

    MediumCVSS 6.9No exploitEPSS 11%

    totolink · a3700r firmwareApr 15, 2025

  • CVE-2025-39538
    26Monitor

    WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability

    MediumCVSS 6.6Proof of conceptEPSS 0%

    mathieu chartier · wp-advanced-searchApr 16, 2025

  • CVE-2025-39601
    38Monitor

    WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    wpfactory · custom css, js & phpApr 16, 2025

  • CVE-2025-23134
    22Monitor

    ALSA: timer: Don't take register_mutex with copy_from/to_user()

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelApr 16, 2025

  • CVE-2025-31200
    75This week

    A memory corruption issue was addressed with improved bounds checking.

    CriticalCVSS 9.8KEVWeaponizedEPSS 20%

    apple · macosApr 16, 2025

  • CVE-2025-31201
    73This week

    This issue was addressed by removing the vulnerable code.

    CriticalCVSS 9.8KEVWeaponizedEPSS 13%

    apple · macosApr 16, 2025

  • CVE-2025-22037
    51Plan

    ksmbd: fix null pointer dereference in alloc_preauth_hash()

    HighCVSS 7.5No exploitEPSS 69%

    linux · linux kernelApr 16, 2025

  • CVE-2025-26153
    21Monitor

    A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Apr 16, 2025

  • CVE-2025-32433
    100Now

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    erlang · erlang\/otpApr 16, 2025

  • CVE-2025-29015
    24Monitor

    Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    codeastro · internet banking systemApr 17, 2025

  • CVE-2025-24752
    24Monitor

    WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 1%

    wpdeveloper · essential addons for elementorApr 17, 2025

  • CVE-2025-32583
    45Plan

    WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 20%

    termel · pdf 2 postApr 17, 2025