By publication date

Exploited and new serious CVEs: May 2025

215 records · 19 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2025-1304Proof of concept	NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Uploadspicethemes · newsblogger · CWE-862 RCE File upload Broken access control (IDOR)	High8.8	—	1.1%	May 1, 2025
60This week	CVE-2025-27007Weaponized	WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerabilitybrainstorm force · ottokit · CWE-266 Pre-auth	Critical9.8	—	54.1%	May 1, 2025
24Monitor	CVE-2025-46565Proof of concept	Vite's server.fs.deny bypassed with /. for files under project rootvitejs · vite · CWE-22 Pre-auth Path traversal	Medium6.0	—	1.1%	May 1, 2025
46Plan	CVE-2025-32011No exploit	KUNBUS Revolution Pi Authentication Bypass by Primary Weaknesskunbus gmbh · revolution pi pictory · CWE-305 Pre-auth Auth bypass Path traversal	Critical9.3	—	28.7%	May 1, 2025
40Plan	CVE-2025-35996No exploit	KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Pagekunbus gmbh · revolution pi pictory · CWE-97	High8.5	—	19.4%	May 1, 2025
26Monitor	CVE-2025-36558No exploit	KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Pagekunbus gmbh · revolution pi pictory · CWE-97 Pre-auth	Medium5.1	—	19.8%	May 1, 2025
25Monitor	CVE-2025-4185No exploit	Wangshen SecGate 3600 g=obj_area_export_save path traversalwangshen · secgate 3600 · CWE-22 Path traversal	Medium5.3	—	13.2%	May 1, 2025
31Monitor	CVE-2024-13322Proof of concept	Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injectionscripteo · ads pro · CWE-89 Pre-auth SQL injection	High7.5	—	1.7%	May 2, 2025
35Monitor	CVE-2024-11142Proof of concept	CSRF in Gosoft Software's Proticaret E-Commerceproticaret · proticaret · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	May 2, 2025
39Monitor	CVE-2025-2812Proof of concept	SQLi in Mydata Informatics' Ticket Sales Automationmydata · ticket sales automation · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	May 2, 2025
40Plan	CVE-2025-2605No exploit	Authenticated command injectionhoneywell · mb-secure firmware · CWE-78 RCE Command injection	High8.8	—	16.0%	May 2, 2025
28Monitor	CVE-2025-4210Proof of concept	Casdoor SCIM User Creation Endpoint scim.go HandleScim authorizationCWE-285 Pre-auth Broken access control (IDOR)	Medium6.9	—	1.8%	May 2, 2025
13Monitor	CVE-2025-47226Proof of concept	Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.snipeitapp · snipe-it · CWE-425	Low3.3	—	1.3%	May 2, 2025
28Monitor	CVE-2025-4255Proof of concept	PCMan FTP Server RMD Command buffer overflowpcman · ftp server · CWE-119 Pre-auth Memory safety	Medium6.9	—	2.1%	May 4, 2025
31Monitor	CVE-2025-4270No exploit	TOTOLINK A720R Config cstecgi.cgi information disclosuretotolink · a720r firmware · CWE-200 Pre-auth Info leak	Medium6.9	—	14.0%	May 5, 2025
66This week	CVE-2025-27920Weaponized	Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling.srimax · output messenger · CWE-24 Path traversal	High8.8	KEV	1.8%	May 5, 2025
32Monitor	CVE-2025-28062Proof of concept	A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3.frappe · erpnext · CWE-352 Pre-auth CSRF	High8.1	—	0.8%	May 5, 2025
29Monitor	CVE-2025-46731Proof of concept	Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTIcraftcms · craft cms · CWE-1336 RCE SSTI	High7.3	—	1.5%	May 5, 2025
28Monitor	CVE-2025-4341No exploit	D-Link DIR-880L Request Header ssdpcgi sub_16570 command injectiondlink · dir-880l firmware · CWE-74 RCE Command injection	Medium5.3	—	24.0%	May 6, 2025
60This week	CVE-2025-2011Weaponized	Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameteraverta · depicter — popup & slider builder · CWE-89 Pre-auth SQL injection	High7.5	—	45.7%	May 6, 2025
25Monitor	CVE-2025-4357No exploit	Tenda RX3 telnet command injectiontenda · rx3 firmware · CWE-74 RCE Command injection	Medium5.1	—	15.7%	May 6, 2025
42Plan	CVE-2025-45487No exploit	Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.linksys · e5600 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	11.5%	May 6, 2025
43Plan	CVE-2025-45488No exploit	Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailexlinksys · e5600 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	11.6%	May 6, 2025
22Monitor	CVE-2025-45250Proof of concept	MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.mrdoc · mrdoc · CWE-918 Pre-auth SSRF	Medium5.5	—	0.2%	May 6, 2025
46Plan	CVE-2025-25014Proof of concept	Kibana arbitrary code execution via prototype pollutionelastic · kibana · CWE-1321 pre-auth RCE Prototype pollution	Critical9.8	—	22.3%	May 6, 2025
28Monitor	CVE-2025-4388Proof of concept	A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Qliferay · digital experience platform · CWE-79 Pre-auth XSS	Medium6.9	—	3.7%	May 6, 2025
37Monitor	CVE-2025-46816Proof of concept	goshs route not protected, allows command executionpatrickhener · goshs · CWE-77 pre-auth RCE Command injection	Critical9.4	—	0.7%	May 6, 2025
28Monitor	CVE-2025-46820Proof of concept	phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifactphpgt · dom · CWE-200 Pre-auth Info leak	High7.1	—	0.1%	May 6, 2025
22Monitor	CVE-2025-47256Proof of concept	Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module inlibxmp · libxmp · CWE-191 Memory safety	Medium5.6	—	0.3%	May 6, 2025
30Monitor	CVE-2025-27533Proof of concept	Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocationapache · activemq · CWE-789	Medium6.9	—	8.9%	May 7, 2025
24Monitor	CVE-2025-29602Proof of concept	flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.flatpress · flatpress · CWE-79 Pre-auth XSS	Medium6.1	—	0.2%	May 7, 2025
30Monitor	CVE-2025-29448Proof of concept	Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causeasyappointments · easy\!appointments · CWE-284 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.5%	May 7, 2025
73This week	CVE-2025-2775Weaponized	SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injectionsysaid · sysaid · CWE-611 Pre-auth XXE	High7.5	KEV	42.6%	May 7, 2025
88Now	CVE-2025-2776Weaponized	SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injectionsysaid · sysaid · CWE-611 Pre-auth XXE	Critical9.8	KEV	64.7%	May 7, 2025
61This week	CVE-2025-2777Proof of concept	SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injectionsysaid · sysaid · CWE-611 Pre-auth XXE	Critical9.8	—	72.6%	May 7, 2025
17Monitor	CVE-2025-47468No exploit	WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerabilityhashthemes · hash form · CWE-352 Pre-auth CSRF	Medium4.3	—	0.1%	May 7, 2025
32Monitor	CVE-2025-47533Proof of concept	WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerabilityiqonic design · graphina · CWE-352 Pre-auth CSRF	High8.1	—	0.3%	May 7, 2025
28Monitor	CVE-2025-47549Proof of concept	WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerabilitythemefic · ultimate before after image slider \& gallery · CWE-434 File upload	High7.2	—	0.5%	May 7, 2025
28Monitor	CVE-2025-47550Proof of concept	WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerabilitythemefic · instantio · CWE-434 File upload	High7.2	—	0.4%	May 7, 2025
26Monitor	CVE-2025-47664No exploit	WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerabilitythimpress · wp pipes · CWE-918 SSRF	Medium6.5	—	0.2%	May 7, 2025
48Plan	CVE-2025-20188Proof of concept	A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles featurescisco · ios xe · CWE-798 pre-auth RCE Path traversal Hard-coded credentials	Critical10.0	—	27.4%	May 7, 2025
35Monitor	CVE-2025-32821No exploit	A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell comsonicwall · sma 100 firmware · CWE-78 RCE Command injection	High7.2	—	22.2%	May 7, 2025
24Monitor	CVE-2025-47423Proof of concept	Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in thepwsdashboard · personal weather station dashboard · CWE-24 Pre-auth Path traversal	Medium5.8	—	1.9%	May 7, 2025
41Plan	CVE-2025-31644Proof of concept	Appliance mode BIG-IP iControl REST and tmsh vulnerabilityf5 · big-ip access policy manager · CWE-77 RCE Command injection	High8.5	—	24.3%	May 7, 2025
60This week	CVE-2025-35939Weaponized	Craft CMS stores user-provided content in session filescraftcms · craft cms · CWE-472 Pre-auth	Medium6.9	KEV	1.3%	May 7, 2025
25Monitor	CVE-2025-32873Proof of concept	An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.djangoproject · django · CWE-770 Pre-auth Denial of service	Medium5.3	—	14.3%	May 8, 2025
30Monitor	CVE-2025-3419Proof of concept	Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Readthemewinter · eventin · CWE-73 Pre-auth Path traversal	High7.5	—	0.7%	May 8, 2025
34Monitor	CVE-2024-6648Proof of concept	Path Traversal in AP Page Builderapollotheme · ap pagebuilder · CWE-22 Pre-auth Path traversal	High8.7	—	0.6%	May 8, 2025
32Monitor	CVE-2025-41450Proof of concept	Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2danfoss · ak-sm 8xxa series · CWE-305 Pre-auth Auth bypass	High8.2	—	0.7%	May 8, 2025
49Plan	CVE-2025-47729Weaponized	The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which itelemessage · text message archiver · CWE-912	Medium4.9	KEV	0.4%	May 8, 2025
24Monitor	CVE-2025-28073Proof of concept	phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.phplist · phplist · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	May 8, 2025
44Plan	CVE-2025-45797No exploit	TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.totolink · a950rg firmware · CWE-787 Pre-auth Memory safety	Critical9.8	—	18.3%	May 8, 2025
24Monitor	CVE-2025-28074Proof of concept	phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.phplist · phplist · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	May 8, 2025
40Plan	CVE-2025-29972Proof of concept	Azure Storage Resource Provider Spoofing Vulnerabilitymicrosoft · azure storage resource provider · CWE-918 Pre-auth SSRF	Critical9.8	—	3.5%	May 8, 2025
40Plan	CVE-2025-4443No exploit	D-Link DIR-605L sub_454F2C command injectiondlink · dir-605l firmware · CWE-74 RCE Command injection	Medium5.3	—	62.7%	May 8, 2025
41Plan	CVE-2025-3605Proof of concept	Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeoverarkenon · login, registration and lost password blocks · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	7.4%	May 9, 2025
40Plan	CVE-2025-4403Proof of concept	Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Functionglenwpcoder · drag and drop multiple file upload for woocommerce · CWE-434 pre-auth RCE File upload	Critical9.8	—	2.2%	May 9, 2025
46Plan	CVE-2025-47269No exploit	code-server session cookie can be extracted by having user visit specially crafted proxy URLcoder · code-server · CWE-441 Pre-auth	High8.3	—	44.5%	May 9, 2025
34Monitor	CVE-2025-4544No exploit	D-Link DI-8100 jhttpd ddos.asp stack-based overflowdlink · di-8100 firmware · CWE-119 Memory safety	High7.5	—	11.8%	May 11, 2025
20Monitor	CVE-2025-41393Proof of concept	Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image ricoh company, ltd. · multiple laser printers and mfps which implement web image monitor · CWE-79 Pre-auth XSS	Medium5.1	—	0.6%	May 12, 2025
21Monitor	CVE-2023-34732Proof of concept	An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to eflytxt · neon-dx · CWE-307	Medium5.4	—	0.2%	May 12, 2025
29Monitor	CVE-2025-44176No exploit	Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.tenda · fh451 firmware · CWE-77 pre-auth RCE Command injection	Medium6.5	—	10.6%	May 12, 2025
26Monitor	CVE-2024-55466Proof of concept	An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 thingsboard · thingsboard · CWE-77 pre-auth RCE File upload Command injection	Medium6.5	—	0.3%	May 12, 2025
30Monitor	CVE-2025-31207Proof of concept	A logic issue was addressed with improved checks.apple · ipados · CWE-200 Info leak	High7.7	—	0.2%	May 12, 2025
26Monitor	CVE-2025-31258Proof of concept	This issue was addressed by removing the vulnerable code.apple · macos · CWE-284 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.4%	May 12, 2025
70This week	CVE-2025-42999Weaponized	Insecure Deserialization in SAP NetWeaver (Visual Composer development server)sap · netweaver · CWE-502 Deserialization	Critical9.1	KEV	12.8%	May 12, 2025
31Monitor	CVE-2025-4396Proof of concept	Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injectionrelevanssi · relevanssi premium · CWE-89 Pre-auth SQL injection	High7.5	—	2.6%	May 13, 2025
76This week	CVE-2025-4632Weaponized	Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attacksamsung · magicinfo 9 server · CWE-22 Pre-auth Path traversal	Critical9.8	KEV	24.0%	May 13, 2025
78This week	CVE-2025-32756Weaponized	A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versionfortinet · fortimail · CWE-121 pre-auth RCE Memory safety	Critical9.8	KEV	30.9%	May 13, 2025
20Monitor	CVE-2025-44039Proof of concept	CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console.cpplusworld · cp-xr-de21-s firmware · CWE-306 Auth bypass	Medium5.1	—	0.2%	May 13, 2025
60This week	CVE-2024-46506Weaponized	NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lnetalertx · netalertx · CWE-306 pre-auth RCE Auth bypass Command injection	Critical10.0	—	62.6%	May 13, 2025
60This week	CVE-2024-48766Weaponized	NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors rnetalertx · netalertx · CWE-698 Pre-auth Path traversal	High8.6	—	67.9%	May 13, 2025
42Plan	CVE-2025-45858No exploit	TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.totolink · a3002r firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	11.0%	May 13, 2025
24Monitor	CVE-2025-46721Proof of concept	nosurf vulnerable to CSRF due to non-functional same-origin request checksnosurf project · nosurf · CWE-352 Pre-auth XSS CSRF	Medium6.0	—	0.2%	May 13, 2025
24Monitor	CVE-2025-47204Proof of concept	An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2.davidstutz · bootstrap multiselect · CWE-352 Pre-auth XSS CSRF	Medium6.1	—	0.4%	May 13, 2025
90Now	CVE-2025-4427Weaponized	Authentication Bypassivanti · endpoint manager mobile · CWE-288 Pre-auth Auth bypass	High7.5	KEV	99.9%	May 13, 2025
91Now	CVE-2025-4428Weaponized	Remote Code Executionivanti · endpoint manager mobile · CWE-94 RCE	High8.8	KEV	88.0%	May 13, 2025
40Plan	CVE-2025-29962No exploit	Windows Media Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 pre-auth RCE Memory safety	High8.8	—	15.5%	May 13, 2025
30Monitor	CVE-2025-29969Proof of concept	MS-EVEN RPC Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-367 RCE Race condition	High7.5	—	1.1%	May 13, 2025
50Plan	CVE-2025-29971No exploit	Web Threat Defense (WTD.sys) Denial of Service Vulnerabilitymicrosoft · windows 11 22h2 · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	68.1%	May 13, 2025
33Monitor	CVE-2025-30394No exploit	Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerabilitymicrosoft · windows server 2012 · CWE-591 Pre-auth Denial of service	Medium5.9	—	34.1%	May 13, 2025
68This week	CVE-2025-30397Weaponized	Scripting Engine Memory Corruption Vulnerabilitymicrosoft · windows 10 1507 · CWE-843 Pre-auth	High7.5	KEV	27.2%	May 13, 2025
62This week	CVE-2025-30400Weaponized	Microsoft DWM Core Library Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-416 Local privilege escalation Memory safety	High7.8	KEV	1.9%	May 13, 2025
61This week	CVE-2025-32701Weaponized	Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 Local privilege escalation Memory safety	High7.8	KEV	1.4%	May 13, 2025
62This week	CVE-2025-32706Weaponized	Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-20 Local privilege escalation	High7.8	KEV	2.3%	May 13, 2025
62This week	CVE-2025-32709Weaponized	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 Local privilege escalation Memory safety	High7.8	KEV	1.8%	May 13, 2025
34Monitor	CVE-2025-4660Proof of concept	Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Accessforescout · secureconnector · CWE-276 RCE Auth bypass	High8.7	—	1.1%	May 13, 2025
43Plan	CVE-2025-43560No exploit	ColdFusion \| Improper Input Validation (CWE-20)adobe · coldfusion · CWE-20 RCE	Critical9.1	—	22.6%	May 13, 2025
43Plan	CVE-2025-43561No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Auth bypass Broken access control (IDOR)	Critical9.1	—	23.9%	May 13, 2025
51Plan	CVE-2025-43562No exploit	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)adobe · coldfusion · CWE-78 RCE Command injection	Critical9.1	—	51.0%	May 13, 2025
41Plan	CVE-2025-43563No exploit	ColdFusion \| Improper Access Control (CWE-284)adobe · coldfusion · CWE-284 Broken access control (IDOR)	Critical9.1	—	16.7%	May 13, 2025
41Plan	CVE-2025-43564Proof of concept	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 Broken access control (IDOR)	Critical9.1	—	16.8%	May 13, 2025
39Monitor	CVE-2025-43565No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Broken access control (IDOR)	High8.4	—	18.4%	May 13, 2025
44Plan	CVE-2025-43566No exploit	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)adobe · coldfusion · CWE-22 Path traversal	Medium6.8	—	58.1%	May 13, 2025
47Plan	CVE-2025-3833No exploit	Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.zohocorp · manageengine adselfservice plus · CWE-89 SQL injection	High8.1	—	50.5%	May 14, 2025
41Plan	CVE-2025-47445Proof of concept	WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerabilitythemewinter · eventin · CWE-23 Pre-auth Path traversal	Critical9.8	—	5.1%	May 14, 2025
39Monitor	CVE-2024-54780No exploit	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget duenetgate · pfsense ce · CWE-94 RCE Command injection	High8.8	—	12.7%	May 14, 2025
38Monitor	CVE-2025-3600No exploit	Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXprogress · telerik ui for asp.net ajax · CWE-470 Pre-auth Denial of service	High7.5	—	26.2%	May 14, 2025
19Monitor	CVE-2025-4664Proof of concept	Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via agoogle · chrome Pre-auth	Medium4.3	—	5.4%	May 14, 2025
24Monitor	CVE-2025-0133Proof of concept	PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portalpalo alto networks · cloud ngfw · CWE-79 Pre-auth XSS	Low2.7	—	46.2%	May 14, 2025

CVE-2025-1304
35Monitor
NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
HighCVSS 8.8Proof of conceptEPSS 1%
- RCE
- File upload
- Broken access control (IDOR)
spicethemes · newsbloggerMay 1, 2025
CVE-2025-27007
60This week
WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
CriticalCVSS 9.8WeaponizedEPSS 54%
- Pre-auth
brainstorm force · ottokitMay 1, 2025
CVE-2025-46565
24Monitor
Vite's server.fs.deny bypassed with /. for files under project root
MediumCVSS 6.0Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
vitejs · viteMay 1, 2025
CVE-2025-32011
46Plan
KUNBUS Revolution Pi Authentication Bypass by Primary Weakness
CriticalCVSS 9.3No exploitEPSS 28%
- Pre-auth
- Auth bypass
- Path traversal
kunbus gmbh · revolution pi pictoryMay 1, 2025
CVE-2025-35996
40Plan
KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
HighCVSS 8.5No exploitEPSS 19%
kunbus gmbh · revolution pi pictoryMay 1, 2025
CVE-2025-36558
26Monitor
KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
MediumCVSS 5.1No exploitEPSS 19%
- Pre-auth
kunbus gmbh · revolution pi pictoryMay 1, 2025
CVE-2025-4185
25Monitor
Wangshen SecGate 3600 g=obj_area_export_save path traversal
MediumCVSS 5.3No exploitEPSS 13%
- Path traversal
wangshen · secgate 3600May 1, 2025
CVE-2024-13322
31Monitor
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
scripteo · ads proMay 2, 2025
CVE-2024-11142
35Monitor
CSRF in Gosoft Software's Proticaret E-Commerce
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- CSRF
proticaret · proticaretMay 2, 2025
CVE-2025-2812
39Monitor
SQLi in Mydata Informatics' Ticket Sales Automation
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
mydata · ticket sales automationMay 2, 2025
CVE-2025-2605
40Plan
Authenticated command injection
HighCVSS 8.8No exploitEPSS 16%
- RCE
- Command injection
honeywell · mb-secure firmwareMay 2, 2025
CVE-2025-4210
28Monitor
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization
MediumCVSS 6.9Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
May 2, 2025
CVE-2025-47226
13Monitor
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
LowCVSS 3.3Proof of conceptEPSS 1%
snipeitapp · snipe-itMay 2, 2025
CVE-2025-4255
28Monitor
PCMan FTP Server RMD Command buffer overflow
MediumCVSS 6.9Proof of conceptEPSS 2%
- Pre-auth
- Memory safety
pcman · ftp serverMay 4, 2025
CVE-2025-4270
31Monitor
TOTOLINK A720R Config cstecgi.cgi information disclosure
MediumCVSS 6.9No exploitEPSS 14%
- Pre-auth
- Info leak
totolink · a720r firmwareMay 5, 2025
CVE-2025-27920
66This week
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling.
HighCVSS 8.8KEVWeaponizedEPSS 1%
- Path traversal
srimax · output messengerMay 5, 2025
CVE-2025-28062
32Monitor
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3.
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
- CSRF
frappe · erpnextMay 5, 2025
CVE-2025-46731
29Monitor
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
HighCVSS 7.3Proof of conceptEPSS 1%
- RCE
- SSTI
craftcms · craft cmsMay 5, 2025
CVE-2025-4341
28Monitor
D-Link DIR-880L Request Header ssdpcgi sub_16570 command injection
MediumCVSS 5.3No exploitEPSS 24%
- RCE
- Command injection
dlink · dir-880l firmwareMay 6, 2025
CVE-2025-2011
60This week
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
HighCVSS 7.5WeaponizedEPSS 45%
- Pre-auth
- SQL injection
averta · depicter — popup & slider builderMay 6, 2025
CVE-2025-4357
25Monitor
Tenda RX3 telnet command injection
MediumCVSS 5.1No exploitEPSS 15%
- RCE
- Command injection
tenda · rx3 firmwareMay 6, 2025
CVE-2025-45487
42Plan
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.
CriticalCVSS 9.8No exploitEPSS 11%
- pre-auth RCE
- Command injection
linksys · e5600 firmwareMay 6, 2025
CVE-2025-45488
43Plan
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex
CriticalCVSS 9.8No exploitEPSS 11%
- pre-auth RCE
- Command injection
linksys · e5600 firmwareMay 6, 2025
CVE-2025-45250
22Monitor
MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- SSRF
mrdoc · mrdocMay 6, 2025
CVE-2025-25014
46Plan
Kibana arbitrary code execution via prototype pollution
CriticalCVSS 9.8Proof of conceptEPSS 22%
- pre-auth RCE
- Prototype pollution
elastic · kibanaMay 6, 2025
CVE-2025-4388
28Monitor
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q
MediumCVSS 6.9Proof of conceptEPSS 3%
- Pre-auth
- XSS
liferay · digital experience platformMay 6, 2025
CVE-2025-46816
37Monitor
goshs route not protected, allows command execution
CriticalCVSS 9.4Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
patrickhener · goshsMay 6, 2025
CVE-2025-46820
28Monitor
phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- Info leak
phpgt · domMay 6, 2025
CVE-2025-47256
22Monitor
Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in
MediumCVSS 5.6Proof of conceptEPSS 0%
- Memory safety
libxmp · libxmpMay 6, 2025
CVE-2025-27533
30Monitor
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
MediumCVSS 6.9Proof of conceptEPSS 8%
apache · activemqMay 7, 2025
CVE-2025-29602
24Monitor
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
flatpress · flatpressMay 7, 2025
CVE-2025-29448
30Monitor
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, caus
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
easyappointments · easy\!appointmentsMay 7, 2025
CVE-2025-2775
73This week
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
HighCVSS 7.5KEVWeaponizedEPSS 42%
- Pre-auth
- XXE
sysaid · sysaidMay 7, 2025
CVE-2025-2776
88Now
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
CriticalCVSS 9.8KEVWeaponizedEPSS 64%
- Pre-auth
- XXE
sysaid · sysaidMay 7, 2025
CVE-2025-2777
61This week
SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
CriticalCVSS 9.8Proof of conceptEPSS 72%
- Pre-auth
- XXE
sysaid · sysaidMay 7, 2025
CVE-2025-47468
17Monitor
WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
hashthemes · hash formMay 7, 2025
CVE-2025-47533
32Monitor
WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerability
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
- CSRF
iqonic design · graphinaMay 7, 2025
CVE-2025-47549
28Monitor
WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability
HighCVSS 7.2Proof of conceptEPSS 0%
- File upload
themefic · ultimate before after image slider \& galleryMay 7, 2025
CVE-2025-47550
28Monitor
WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability
HighCVSS 7.2Proof of conceptEPSS 0%
- File upload
themefic · instantioMay 7, 2025
CVE-2025-47664
26Monitor
WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- SSRF
thimpress · wp pipesMay 7, 2025
CVE-2025-20188
48Plan
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features
CriticalCVSS 10.0Proof of conceptEPSS 27%
- pre-auth RCE
- Path traversal
- Hard-coded credentials
cisco · ios xeMay 7, 2025
CVE-2025-32821
35Monitor
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell com
HighCVSS 7.2No exploitEPSS 22%
- RCE
- Command injection
sonicwall · sma 100 firmwareMay 7, 2025
CVE-2025-47423
24Monitor
Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the
MediumCVSS 5.8Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
pwsdashboard · personal weather station dashboardMay 7, 2025
CVE-2025-31644
41Plan
Appliance mode BIG-IP iControl REST and tmsh vulnerability
HighCVSS 8.5Proof of conceptEPSS 24%
- RCE
- Command injection
f5 · big-ip access policy managerMay 7, 2025
CVE-2025-35939
60This week
Craft CMS stores user-provided content in session files
MediumCVSS 6.9KEVWeaponizedEPSS 1%
- Pre-auth
craftcms · craft cmsMay 7, 2025
CVE-2025-32873
25Monitor
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.
MediumCVSS 5.3Proof of conceptEPSS 14%
- Pre-auth
- Denial of service
djangoproject · djangoMay 8, 2025
CVE-2025-3419
30Monitor
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
themewinter · eventinMay 8, 2025
CVE-2024-6648
34Monitor
Path Traversal in AP Page Builder
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
apollotheme · ap pagebuilderMay 8, 2025
CVE-2025-41450
32Monitor
Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
danfoss · ak-sm 8xxa seriesMay 8, 2025
CVE-2025-47729
49Plan
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which i
MediumCVSS 4.9KEVWeaponizedEPSS 0%
telemessage · text message archiverMay 8, 2025
CVE-2025-28073
24Monitor
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
phplist · phplistMay 8, 2025
CVE-2025-45797
44Plan
TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.
CriticalCVSS 9.8No exploitEPSS 18%
- Pre-auth
- Memory safety
totolink · a950rg firmwareMay 8, 2025
CVE-2025-28074
24Monitor
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
phplist · phplistMay 8, 2025
CVE-2025-29972
40Plan
Azure Storage Resource Provider Spoofing Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
- SSRF
microsoft · azure storage resource providerMay 8, 2025
CVE-2025-4443
40Plan
D-Link DIR-605L sub_454F2C command injection
MediumCVSS 5.3No exploitEPSS 62%
- RCE
- Command injection
dlink · dir-605l firmwareMay 8, 2025
CVE-2025-3605
41Plan
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 7%
- Pre-auth
- Broken access control (IDOR)
arkenon · login, registration and lost password blocksMay 9, 2025
CVE-2025-4403
40Plan
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
CriticalCVSS 9.8Proof of conceptEPSS 2%
- pre-auth RCE
- File upload
glenwpcoder · drag and drop multiple file upload for woocommerceMay 9, 2025
CVE-2025-47269
46Plan
code-server session cookie can be extracted by having user visit specially crafted proxy URL
HighCVSS 8.3No exploitEPSS 44%
- Pre-auth
coder · code-serverMay 9, 2025
CVE-2025-4544
34Monitor
D-Link DI-8100 jhttpd ddos.asp stack-based overflow
HighCVSS 7.5No exploitEPSS 11%
- Memory safety
dlink · di-8100 firmwareMay 11, 2025
CVE-2025-41393
20Monitor
Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image
MediumCVSS 5.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
ricoh company, ltd. · multiple laser printers and mfps which implement web image monitorMay 12, 2025
CVE-2023-34732
21Monitor
An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to e
MediumCVSS 5.4Proof of conceptEPSS 0%
flytxt · neon-dxMay 12, 2025
CVE-2025-44176
29Monitor
Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.
MediumCVSS 6.5No exploitEPSS 10%
- pre-auth RCE
- Command injection
tenda · fh451 firmwareMay 12, 2025
CVE-2024-55466
26Monitor
An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1
MediumCVSS 6.5Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
- Command injection
thingsboard · thingsboardMay 12, 2025
CVE-2025-31207
30Monitor
A logic issue was addressed with improved checks.
HighCVSS 7.7Proof of conceptEPSS 0%
- Info leak
apple · ipadosMay 12, 2025
CVE-2025-31258
26Monitor
This issue was addressed by removing the vulnerable code.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · macosMay 12, 2025
CVE-2025-42999
70This week
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
CriticalCVSS 9.1KEVWeaponizedEPSS 12%
- Deserialization
sap · netweaverMay 12, 2025
CVE-2025-4396
31Monitor
Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
relevanssi · relevanssi premiumMay 13, 2025
CVE-2025-4632
76This week
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attack
CriticalCVSS 9.8KEVWeaponizedEPSS 24%
- Pre-auth
- Path traversal
samsung · magicinfo 9 serverMay 13, 2025
CVE-2025-32756
78This week
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all version
CriticalCVSS 9.8KEVWeaponizedEPSS 30%
- pre-auth RCE
- Memory safety
fortinet · fortimailMay 13, 2025
CVE-2025-44039
20Monitor
CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console.
MediumCVSS 5.1Proof of conceptEPSS 0%
- Auth bypass
cpplusworld · cp-xr-de21-s firmwareMay 13, 2025
CVE-2024-46506
60This week
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings l
CriticalCVSS 10.0WeaponizedEPSS 62%
- pre-auth RCE
- Auth bypass
- Command injection
netalertx · netalertxMay 13, 2025
CVE-2024-48766
60This week
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors r
HighCVSS 8.6WeaponizedEPSS 67%
- Pre-auth
- Path traversal
netalertx · netalertxMay 13, 2025
CVE-2025-45858
42Plan
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.
CriticalCVSS 9.8No exploitEPSS 11%
- pre-auth RCE
- Command injection
totolink · a3002r firmwareMay 13, 2025
CVE-2025-46721
24Monitor
nosurf vulnerable to CSRF due to non-functional same-origin request checks
MediumCVSS 6.0Proof of conceptEPSS 0%
- Pre-auth
- XSS
- CSRF
nosurf project · nosurfMay 13, 2025
CVE-2025-47204
24Monitor
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
- CSRF
davidstutz · bootstrap multiselectMay 13, 2025
CVE-2025-4427
90Now
Authentication Bypass
HighCVSS 7.5KEVWeaponizedEPSS 99%
- Pre-auth
- Auth bypass
ivanti · endpoint manager mobileMay 13, 2025
CVE-2025-4428
91Now
Remote Code Execution
HighCVSS 8.8KEVWeaponizedEPSS 88%
- RCE
ivanti · endpoint manager mobileMay 13, 2025
CVE-2025-29962
40Plan
Windows Media Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1507May 13, 2025
CVE-2025-29969
30Monitor
MS-EVEN RPC Remote Code Execution Vulnerability
HighCVSS 7.5Proof of conceptEPSS 1%
- RCE
- Race condition
microsoft · windows 10 1507May 13, 2025
CVE-2025-29971
50Plan
Web Threat Defense (WTD.sys) Denial of Service Vulnerability
HighCVSS 7.5No exploitEPSS 68%
- Pre-auth
- Memory safety
- Denial of service
microsoft · windows 11 22h2May 13, 2025
CVE-2025-30394
33Monitor
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
MediumCVSS 5.9No exploitEPSS 34%
- Pre-auth
- Denial of service
microsoft · windows server 2012May 13, 2025
CVE-2025-30397
68This week
Scripting Engine Memory Corruption Vulnerability
HighCVSS 7.5KEVWeaponizedEPSS 27%
- Pre-auth
microsoft · windows 10 1507May 13, 2025
CVE-2025-30400
62This week
Microsoft DWM Core Library Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 1%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1809May 13, 2025
CVE-2025-32701
61This week
Windows Common Log File System Driver Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 1%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507May 13, 2025
CVE-2025-32706
62This week
Windows Common Log File System Driver Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 2%
- Local privilege escalation
microsoft · windows 10 1507May 13, 2025
CVE-2025-32709
62This week
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 1%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507May 13, 2025
CVE-2025-4660
34Monitor
Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access
HighCVSS 8.7Proof of conceptEPSS 1%
- RCE
- Auth bypass
forescout · secureconnectorMay 13, 2025
CVE-2025-43560
43Plan
ColdFusion | Improper Input Validation (CWE-20)
CriticalCVSS 9.1No exploitEPSS 22%
- RCE
adobe · coldfusionMay 13, 2025
CVE-2025-43561
43Plan
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.1No exploitEPSS 23%
- RCE
- Auth bypass
- Broken access control (IDOR)
adobe · coldfusionMay 13, 2025
CVE-2025-43562
51Plan
ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
CriticalCVSS 9.1No exploitEPSS 51%
- RCE
- Command injection
adobe · coldfusionMay 13, 2025
CVE-2025-43563
41Plan
ColdFusion | Improper Access Control (CWE-284)
CriticalCVSS 9.1No exploitEPSS 16%
- Broken access control (IDOR)
adobe · coldfusionMay 13, 2025
CVE-2025-43564
41Plan
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.1Proof of conceptEPSS 16%
- Broken access control (IDOR)
adobe · coldfusionMay 13, 2025
CVE-2025-43565
39Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.4No exploitEPSS 18%
- RCE
- Broken access control (IDOR)
adobe · coldfusionMay 13, 2025
CVE-2025-43566
44Plan
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
MediumCVSS 6.8No exploitEPSS 58%
- Path traversal
adobe · coldfusionMay 13, 2025
CVE-2025-3833
47Plan
Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.
HighCVSS 8.1No exploitEPSS 50%
- SQL injection
zohocorp · manageengine adselfservice plusMay 14, 2025
CVE-2025-47445
41Plan
WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 5%
- Pre-auth
- Path traversal
themewinter · eventinMay 14, 2025
CVE-2024-54780
39Monitor
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due
HighCVSS 8.8No exploitEPSS 12%
- RCE
- Command injection
netgate · pfsense ceMay 14, 2025
CVE-2025-3600
38Monitor
Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX
HighCVSS 7.5No exploitEPSS 26%
- Pre-auth
- Denial of service
progress · telerik ui for asp.net ajaxMay 14, 2025
CVE-2025-4664
19Monitor
Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a
MediumCVSS 4.3Proof of conceptEPSS 5%
- Pre-auth
google · chromeMay 14, 2025
CVE-2025-0133
24Monitor
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal
LowCVSS 2.7Proof of conceptEPSS 46%
- Pre-auth
- XSS
palo alto networks · cloud ngfwMay 14, 2025