By publication date

Exploited and new serious CVEs: May 2025

216 records · 19 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
14Monitor	CVE-2025-32421Proof of concept	Next.js Race Condition to Cache Poisoningvercel · next.js · CWE-362 Pre-auth Race condition	Low3.7	—	0.8%	May 14, 2025
30Monitor	CVE-2025-47783Proof of concept	label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.humansignal · label studio · CWE-79 Pre-auth XSS	High7.6	—	0.5%	May 14, 2025
25Monitor	CVE-2025-4126Proof of concept	EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeemmanuelg · eg-series · CWE-80 XSS	Medium6.4	—	0.2%	May 15, 2025
21Monitor	CVE-2023-6030Proof of concept	LogDash Activity Log < 1.1.4 - Unauthenticated SQLideryckoe · logdash activity log · CWE-89 SQL injection	Medium5.4	—	0.8%	May 15, 2025
24Monitor	CVE-2023-6786Proof of concept	Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirecthkdigit · payment gateway for telcell · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.5%	May 15, 2025
29Monitor	CVE-2023-7231Proof of concept	illi Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletionevanliewer · illi link party\! · CWE-284 Pre-auth Broken access control (IDOR)	High7.3	—	0.4%	May 15, 2025
24Monitor	CVE-2024-12724Proof of concept	WP DeskLite <= 1.0.0 - Reflected XSScodeflock · wp desklite · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	May 15, 2025
24Monitor	CVE-2024-12732Proof of concept	AffiliateImporterEb <= 1.0.6 - Reflected XSScr1000 · affiliateimportereb · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	May 15, 2025
24Monitor	CVE-2024-12734Proof of concept	Advance Post Prefix <= 1.1.1 - Reflected XSSniceit · advance post prefix · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	May 15, 2025
24Monitor	CVE-2024-12873Proof of concept	Custom Field Manager <= 1.0 - Reflected XSS Vulnerabilityf1logic · custom field manager · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	May 15, 2025
24Monitor	CVE-2024-13619Proof of concept	LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSSlifterlms · lifterlms · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	May 15, 2025
24Monitor	CVE-2024-13727Proof of concept	MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSSmemberspace · memberspace · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	May 15, 2025
40Plan	CVE-2024-6159Proof of concept	Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLipnfpb · push notification for post and buddypress · CWE-89 Pre-auth SQL injection	Critical9.8	—	2.7%	May 15, 2025
24Monitor	CVE-2024-6690Proof of concept	WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirectwp-buy · wp content copy protection \& no right click · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.5%	May 15, 2025
37Monitor	CVE-2024-8673Proof of concept	Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Uploadurbanbase · z-downloads · CWE-79 Pre-auth XSS	Critical9.1	—	1.8%	May 15, 2025
26Monitor	CVE-2024-9765Proof of concept	EKC Tournament Manager < 2.2.2 - Local File Download Vulnerabilitylukashuser · ekc tournament manager · CWE-552	Medium6.5	—	1.6%	May 15, 2025
24Monitor	CVE-2025-1303Proof of concept	Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSScoffee-code · plugin oficial · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	May 15, 2025
31Monitor	CVE-2025-47161Proof of concept	Microsoft Defender for Endpoint Elevation of Privilege Vulnerabilitymicrosoft · defender for endpoint · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.8%	May 15, 2025
36Monitor	CVE-2025-47928Proof of concept	Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`spotipy-dev · spotipy · CWE-488 Pre-auth	Critical9.1	—	0.6%	May 15, 2025
21Monitor	CVE-2025-4720Proof of concept	SourceCodester Student Result Management System drop_student.php path traversalmunyweki · student result management system · CWE-22 Path traversal	Medium5.3	—	0.6%	May 15, 2025
26Monitor	CVE-2025-4679Proof of concept	A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecsynology · active backup for microsoft 365 · CWE-522 Info leak	Medium6.5	—	1.0%	May 16, 2025
20Monitor	CVE-2025-40630Proof of concept	Open redirection vulnerability in IceWarp Mail Servericewarp · mail server · CWE-601 Pre-auth Open redirect	Medium5.1	—	0.4%	May 16, 2025
34Monitor	CVE-2025-40629Proof of concept	Path Traversal vulnerability in PNETLabpnetlab · pnetlab · CWE-22 Pre-auth Path traversal	High8.7	—	0.8%	May 16, 2025
64This week	CVE-2025-47916Weaponized	Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity · invisioncommunity · CWE-1336 pre-auth RCE SSTI	Critical9.8	—	84.3%	May 16, 2025
35Monitor	CVE-2025-39507Proof of concept	WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerabilitynasatheme · nasa core · CWE-98	High8.8	—	0.8%	May 16, 2025
17Monitor	CVE-2025-4476Proof of concept	Libsoup: null pointer dereference in libsoup may lead to denial of servicered hat · red hat enterprise linux 10 · CWE-476 Pre-auth Memory safety Denial of service	Medium4.3	—	0.3%	May 16, 2025
31Monitor	CVE-2025-4802Proof of concept	Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading ofgnu · glibc · CWE-426	High7.8	—	0.5%	May 16, 2025
23Monitor	CVE-2025-32407Proof of concept	Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allsamsung · internet · CWE-295 Pre-auth Weak crypto	Medium5.9	—	0.2%	May 16, 2025
28Monitor	CVE-2025-4190Proof of concept	CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Uploadaleapp · csv mass importer · CWE-434 File upload	High7.2	—	0.5%	May 17, 2025
39Monitor	CVE-2025-4389Proof of concept	Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Uploadcoderevolution · crawlomatic multipage scraper post generator · CWE-434 pre-auth RCE File upload	Critical9.8	—	1.0%	May 17, 2025
30Monitor	CVE-2025-47273Proof of concept	setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Writepython · setuptools · CWE-22 pre-auth RCE Path traversal	High7.7	—	1.5%	May 17, 2025
11Monitor	CVE-2025-47931No exploit	LibreNMS stored Cross-site Scripting vulnerability in poller group namelibrenms · librenms · CWE-79 Pre-auth XSS	Low2.1	—	10.1%	May 17, 2025
21Monitor	CVE-2025-4866Proof of concept	weibocom rill-flow Management Console code injectionweibo · rill-flow · CWE-74 RCE	Medium5.3	—	0.6%	May 18, 2025
28Monitor	CVE-2025-4871Proof of concept	PCMan FTP Server REST Command buffer overflowpcman · ftp server · CWE-119 Pre-auth Memory safety	Medium6.9	—	1.7%	May 18, 2025
45Plan	CVE-2025-4901No exploit	D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosuredlink · di-7003g firmware · CWE-200 Pre-auth Info leak	Medium5.3	—	78.8%	May 18, 2025
31Monitor	CVE-2025-4902No exploit	D-Link DI-7003GV2 versionupdate.data sub_48F4F0 information disclosuredlink · di-7003g firmware · CWE-200 Pre-auth Info leak	Medium6.9	—	14.7%	May 18, 2025
26Monitor	CVE-2025-23167Proof of concept	A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.nodejs · node · CWE-444 Pre-auth	Medium6.5	—	0.5%	May 18, 2025
19Monitor	CVE-2025-44108Proof of concept	A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions coflatpress · flatpress · CWE-79 XSS	Medium4.8	—	0.3%	May 19, 2025
21Monitor	CVE-2024-33939Proof of concept	WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerabilitythemegrill · masteriyo · CWE-288 Pre-auth Auth bypass	Medium5.3	—	0.9%	May 19, 2025
39Monitor	CVE-2025-26892Proof of concept	WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerabilitydkszone · celestial aura · CWE-434 File upload	Critical9.9	—	0.6%	May 19, 2025
29Monitor	CVE-2025-39459Proof of concept	WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerabilitycontempoinc · real estate 7 · CWE-266 Pre-auth	High7.3	—	0.3%	May 19, 2025
41Plan	CVE-2025-47577Proof of concept	WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerabilitytemplateinvaders · ti woocommerce wishlist · CWE-434 Pre-auth File upload	Critical10.0	—	4.5%	May 19, 2025
35Monitor	CVE-2025-39366No exploit	WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerabilityrocket apps · wproject · CWE-266	High8.8	—	0.3%	May 19, 2025
40Plan	CVE-2025-39401Proof of concept	WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerabilitymojoomla · wpams · CWE-434 Pre-auth File upload	Critical10.0	—	0.5%	May 19, 2025
34Monitor	CVE-2025-4971Proof of concept	Broadcom Automic Automation Agent Unix privilege escalationbroadcom · automic automation · CWE-426 Local privilege escalation	High8.5	—	0.5%	May 19, 2025
44Plan	CVE-2025-4322Proof of concept	Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeoverstylemixthemes · motors - car dealer, rental & listing wordpress theme · CWE-620 Pre-auth	Critical9.8	—	15.1%	May 20, 2025
36Monitor	CVE-2025-40634Proof of concept	Stack-based buffer overflow in TP-Link Archer AX50tp-link · link archer ax50 · CWE-121 pre-auth RCE Memory safety	Critical9.2	—	0.6%	May 20, 2025
43Plan	CVE-2025-4978No exploit	Netgear DGND3700 Basic Authentication BRS_top.html improper authenticationnetgear · dgnd3700 firmware · CWE-287 Pre-auth Auth bypass	Critical9.3	—	21.4%	May 20, 2025
34Monitor	CVE-2025-26086No exploit	An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get requersiqueue · management system · CWE-89 Pre-auth Auth bypass SQL injection	High7.5	—	14.6%	May 20, 2025
17Monitor	CVE-2025-41228Proof of concept	VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerabilityvmware · vcenter server · CWE-79 Pre-auth XSS	Medium4.3	—	0.8%	May 20, 2025
31Monitor	CVE-2025-37899Proof of concept	ksmbd: fix use-after-free in session logofflinux · linux kernel · CWE-416 Memory safety	High7.8	—	0.8%	May 20, 2025
31Monitor	CVE-2025-37928Proof of concept	dm-bufio: don't schedule in atomic contextlinux · linux kernel	High7.8	—	0.7%	May 20, 2025
31Monitor	CVE-2025-37947Proof of concept	ksmbd: prevent out-of-bounds stream writes by validating *poslinux · linux kernel · CWE-787 Memory safety	High7.8	—	0.6%	May 20, 2025
45Plan	CVE-2025-44084No exploit	D-link DI-8100 16.07.26A1 is vulnerable to Command Injection.dlink · di-8100g firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	21.5%	May 20, 2025
38Monitor	CVE-2025-37924No exploit	ksmbd: fix use-after-free in kerberos authenticationlinux · linux kernel · CWE-416 Memory safety	High7.8	—	22.0%	May 20, 2025
44Plan	CVE-2025-4094Proof of concept	Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcingunitedover · digits · CWE-307 Pre-auth Auth bypass	Critical9.8	—	16.4%	May 21, 2025
42Plan	CVE-2025-4524Proof of concept	Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusionwpstylish · madara – responsive and modern wordpress theme for manga sites · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	10.5%	May 21, 2025
25Monitor	CVE-2025-4611Proof of concept	Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcoderilwis · slim seo – a fast & automated seo plugin for wordpress · CWE-79 XSS	Medium6.4	—	0.5%	May 21, 2025
35Monitor	CVE-2025-40775Proof of concept	DNS message with invalid TSIG causes an assertion failureisc · bind 9 · CWE-232 Pre-auth Denial of service	High7.5	—	15.3%	May 21, 2025
30Monitor	CVE-2024-56429Proof of concept	itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to titech · ilabclient · CWE-321 Hard-coded credentials	High7.7	—	0.1%	May 21, 2025
92Now	CVE-2025-4008Weaponized	Arbitrary Command Injection in Smartbedded MeteoBridgesmartbedded · meteobridge vm · CWE-77 pre-auth RCE Command injection	High8.7	KEV	93.3%	May 21, 2025
22Monitor	CVE-2024-56428Proof of concept	The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for thitech-gmbh · ilabclient · CWE-312	Medium5.5	—	0.1%	May 21, 2025
31Monitor	CVE-2025-46822Proof of concept	Unauthenticated Arbitrary File Read via Absolute Pathosamataher · java-springboot-codebase · CWE-36 Pre-auth Path traversal	High7.7	—	4.0%	May 21, 2025
30Monitor	CVE-2025-48060Proof of concept	AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)jqlang · jq · CWE-121 Pre-auth Memory safety	High7.7	—	0.5%	May 21, 2025
36Monitor	CVE-2025-27558Proof of concept	IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks.CWE-345 Pre-auth	Critical9.1	—	0.3%	May 21, 2025
91Now	CVE-2025-34026Weaponized	Versa Concerto Actuator Authentication Bypass Information Leakversa-networks · concerto · CWE-288 Pre-auth Auth bypass	Critical9.2	KEV	81.7%	May 21, 2025
54Plan	CVE-2025-34027Proof of concept	Versa Concerto Authentication Bypass File Write Remote Code Executionversa-networks · concerto · CWE-367 pre-auth RCE Auth bypass Race condition	Critical10.0	—	46.1%	May 21, 2025
30Monitor	CVE-2025-47947Proof of concept	ModSecurity Has Possible DoS Vulnerabilitytrustwave · modsecurity · CWE-1050 Pre-auth Denial of service	High7.5	—	0.5%	May 21, 2025
53Plan	CVE-2025-4123Proof of concept	A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.grafana · grafana · CWE-79 pre-auth RCE SSRF Path traversal XSS	Medium6.1	—	97.0%	May 22, 2025
39Monitor	CVE-2025-3937No exploit	Use of Password Hash with Insufficient Computational Efforttridium · niagara · CWE-916 Pre-auth	Critical9.8	—	0.3%	May 22, 2025
33Monitor	CVE-2025-3943No exploit	Use of GET Request Method With sensitive Query Stringstridium · niagara · CWE-598 Pre-auth	High7.5	—	10.1%	May 22, 2025
41Plan	CVE-2025-32813Proof of concept	An issue was discovered in Infoblox NETMRI before 7.6.1.infoblox · netmri · CWE-77 RCE Command injection	High7.2	—	43.2%	May 22, 2025
50Plan	CVE-2025-32814Proof of concept	An issue was discovered in Infoblox NETMRI before 7.6.1.infoblox · netmri · CWE-89 Pre-auth SQL injection	Critical9.8	—	35.8%	May 22, 2025
38Monitor	CVE-2025-32815Proof of concept	An issue was discovered in Infoblox NETMRI before 7.6.1.infoblox · netmri · CWE-287 Pre-auth Auth bypass Hard-coded credentials	Medium6.5	—	39.1%	May 22, 2025
38Monitor	CVE-2024-52874No exploit	In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks.infoblox · netmri · CWE-89 SQL injection	High8.8	—	10.6%	May 22, 2025
28Monitor	CVE-2024-13946Proof of concept	Binary Planting / LoadLibrary DLL's not Signedabb · aspect-enterprise · CWE-427	High7.1	—	1.0%	May 22, 2025
35Monitor	CVE-2025-47181Proof of concept	Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerabilitymicrosoft · edge update · CWE-59 Local privilege escalation	High8.8	—	0.6%	May 22, 2025
13Monitor	CVE-2025-48708Proof of concept	gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case.artifex · ghostscript · CWE-212	Low3.3	—	0.3%	May 23, 2025
44Plan	CVE-2025-36527No exploit	Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.zohocorp · manageengine adaudit plus · CWE-89 SQL injection	High8.3	—	38.2%	May 23, 2025
47Plan	CVE-2025-47539Proof of concept	WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerabilitythemewinter · eventin · CWE-266 Pre-auth	Critical9.8	—	25.2%	May 23, 2025
46Plan	CVE-2025-47646Proof of concept	WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerabilitygilblas ngunte possi · psw front-end login & registration · CWE-640 Pre-auth	Critical9.8	—	24.5%	May 23, 2025
33Monitor	CVE-2025-32794No exploit	OpenEMR Stored XSS via Patient Name Field in Procedure Ordersopen-emr · openemr · CWE-79 XSS	High7.6	—	10.4%	May 23, 2025
21Monitor	CVE-2025-32967No exploit	OpenEMR doesn't log password administration properlyopen-emr · openemr · CWE-778	Medium5.4	—	0.2%	May 23, 2025
35Monitor	CVE-2025-43860No exploit	OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographicsopen-emr · openemr · CWE-79 XSS	High7.6	—	15.0%	May 23, 2025
24Monitor	CVE-2025-44998Proof of concept	A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to executprasathmani · tiny file manager · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	May 23, 2025
39Monitor	CVE-2025-4336Proof of concept	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()emagicone · emagicone store manager for woocommerce · CWE-434 pre-auth RCE File upload Hard-coded credentials	Critical9.8	—	1.4%	May 24, 2025
30Monitor	CVE-2025-4602Proof of concept	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Reademagicone · emagicone store manager for woocommerce · CWE-73 Pre-auth Path traversal Hard-coded credentials	High7.5	—	0.7%	May 24, 2025
36Monitor	CVE-2025-4603Proof of concept	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletionemagicone · emagicone store manager for woocommerce · CWE-73 pre-auth RCE Path traversal Hard-coded credentials	Critical9.1	—	1.5%	May 24, 2025
39Monitor	CVE-2025-5058Proof of concept	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()emagicone · emagicone store manager for woocommerce · CWE-434 pre-auth RCE File upload Hard-coded credentials	Critical9.8	—	1.4%	May 24, 2025
7Monitor	CVE-2025-5154Proof of concept	PhonePe App SQLite Database databases cleartext storage in filephonepe · phonepe · CWE-312	Low1.8	—	0.1%	May 25, 2025
21Monitor	CVE-2025-5182Proof of concept	Summer Pearl Group Vacation Rental Management Platform Listing authorizationsummerpearlgroup · vacation rental management platform · CWE-285 Broken access control (IDOR)	Medium5.3	—	0.4%	May 26, 2025
30Monitor	CVE-2025-5196Proof of concept	Wing FTP Server Lua Admin Console unnecessary privilegeswftpserver · wing ftp server · CWE-250	High7.5	—	1.1%	May 26, 2025
62This week	CVE-2025-48827Weaponized	vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningvbulletin · vbulletin · CWE-424 Pre-auth	Critical9.8	—	75.6%	May 27, 2025
60This week	CVE-2025-48828Weaponized	Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vbulletin · vbulletin · CWE-424 pre-auth RCE	High8.1	—	57.2%	May 27, 2025
31Monitor	CVE-2025-23247Proof of concept	NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coulnvidia · cuda toolkit · CWE-130 RCE	High7.8	—	0.3%	May 27, 2025
24Monitor	CVE-2025-46173Proof of concept	code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.code-projects · online exam mastering system · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	May 27, 2025
39Monitor	CVE-2025-32440Proof of concept	NetAlertX Vulnerable to Authentication Bypassnetalertx · netalertx · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.6%	May 27, 2025
28Monitor	CVE-2025-5222Proof of concept	Icu: stack buffer overflow in the srbroot::addtag functionunicode · international components for unicode · CWE-120 RCE Memory safety	High7.0	—	0.4%	May 27, 2025
58Plan	CVE-2025-4009Proof of concept	Unauthenticated Arbitrary Command Injection in Evertz SDVNevertz · 3080ipx-10g · CWE-77 pre-auth RCE Auth bypass Command injection	Critical9.3	—	71.4%	May 28, 2025
19Monitor	CVE-2025-5025Proof of concept	No QUIC certificate pinning with wolfSSLhaxx · curl · CWE-295 Pre-auth Weak crypto	Medium4.8	—	0.2%	May 28, 2025

CVE-2025-32421
14Monitor
Next.js Race Condition to Cache Poisoning
LowCVSS 3.7Proof of conceptEPSS 0%
- Pre-auth
- Race condition
vercel · next.jsMay 14, 2025
CVE-2025-47783
30Monitor
label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
HighCVSS 7.6Proof of conceptEPSS 0%
- Pre-auth
- XSS
humansignal · label studioMay 14, 2025
CVE-2025-4126
25Monitor
EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MediumCVSS 6.4Proof of conceptEPSS 0%
- XSS
emmanuelg · eg-seriesMay 15, 2025
CVE-2023-6030
21Monitor
LogDash Activity Log < 1.1.4 - Unauthenticated SQLi
MediumCVSS 5.4Proof of conceptEPSS 0%
- SQL injection
deryckoe · logdash activity logMay 15, 2025
CVE-2023-6786
24Monitor
Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
hkdigit · payment gateway for telcellMay 15, 2025
CVE-2023-7231
29Monitor
illi Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletion
HighCVSS 7.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
evanliewer · illi link party\!May 15, 2025
CVE-2024-12724
24Monitor
WP DeskLite <= 1.0.0 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
codeflock · wp deskliteMay 15, 2025
CVE-2024-12732
24Monitor
AffiliateImporterEb <= 1.0.6 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
cr1000 · affiliateimporterebMay 15, 2025
CVE-2024-12734
24Monitor
Advance Post Prefix <= 1.1.1 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
niceit · advance post prefixMay 15, 2025
CVE-2024-12873
24Monitor
Custom Field Manager <= 1.0 - Reflected XSS Vulnerability
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
f1logic · custom field managerMay 15, 2025
CVE-2024-13619
24Monitor
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
lifterlms · lifterlmsMay 15, 2025
CVE-2024-13727
24Monitor
MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
memberspace · memberspaceMay 15, 2025
CVE-2024-6159
40Plan
Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
pnfpb · push notification for post and buddypressMay 15, 2025
CVE-2024-6690
24Monitor
WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
wp-buy · wp content copy protection \& no right clickMay 15, 2025
CVE-2024-8673
37Monitor
Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
urbanbase · z-downloadsMay 15, 2025
CVE-2024-9765
26Monitor
EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability
MediumCVSS 6.5Proof of conceptEPSS 1%
lukashuser · ekc tournament managerMay 15, 2025
CVE-2025-1303
24Monitor
Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
coffee-code · plugin oficialMay 15, 2025
CVE-2025-47161
31Monitor
Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
microsoft · defender for endpointMay 15, 2025
CVE-2025-47928
36Monitor
Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
spotipy-dev · spotipyMay 15, 2025
CVE-2025-4720
21Monitor
SourceCodester Student Result Management System drop_student.php path traversal
MediumCVSS 5.3Proof of conceptEPSS 0%
- Path traversal
munyweki · student result management systemMay 15, 2025
CVE-2025-4679
26Monitor
A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspec
MediumCVSS 6.5Proof of conceptEPSS 1%
- Info leak
synology · active backup for microsoft 365May 16, 2025
CVE-2025-40630
20Monitor
Open redirection vulnerability in IceWarp Mail Server
MediumCVSS 5.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
icewarp · mail serverMay 16, 2025
CVE-2025-40629
34Monitor
Path Traversal vulnerability in PNETLab
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
pnetlab · pnetlabMay 16, 2025
CVE-2025-47916
64This week
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.
CriticalCVSS 9.8WeaponizedEPSS 84%
- pre-auth RCE
- SSTI
invisioncommunity · invisioncommunityMay 16, 2025
CVE-2025-39507
35Monitor
WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
nasatheme · nasa coreMay 16, 2025
CVE-2025-4476
17Monitor
Libsoup: null pointer dereference in libsoup may lead to denial of service
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
red hat · red hat enterprise linux 10May 16, 2025
CVE-2025-4802
31Monitor
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of
HighCVSS 7.8Proof of conceptEPSS 0%
gnu · glibcMay 16, 2025
CVE-2025-32407
23Monitor
Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, all
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
samsung · internetMay 16, 2025
CVE-2025-4190
28Monitor
CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload
HighCVSS 7.2Proof of conceptEPSS 0%
- File upload
aleapp · csv mass importerMay 17, 2025
CVE-2025-4389
39Monitor
Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
coderevolution · crawlomatic multipage scraper post generatorMay 17, 2025
CVE-2025-47273
30Monitor
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
HighCVSS 7.7Proof of conceptEPSS 1%
- pre-auth RCE
- Path traversal
python · setuptoolsMay 17, 2025
CVE-2025-47931
11Monitor
LibreNMS stored Cross-site Scripting vulnerability in poller group name
LowCVSS 2.1No exploitEPSS 10%
- Pre-auth
- XSS
librenms · librenmsMay 17, 2025
CVE-2025-4866
21Monitor
weibocom rill-flow Management Console code injection
MediumCVSS 5.3Proof of conceptEPSS 0%
- RCE
weibo · rill-flowMay 18, 2025
CVE-2025-4871
28Monitor
PCMan FTP Server REST Command buffer overflow
MediumCVSS 6.9Proof of conceptEPSS 1%
- Pre-auth
- Memory safety
pcman · ftp serverMay 18, 2025
CVE-2025-4901
45Plan
D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosure
MediumCVSS 5.3No exploitEPSS 78%
- Pre-auth
- Info leak
dlink · di-7003g firmwareMay 18, 2025
CVE-2025-4902
31Monitor
D-Link DI-7003GV2 versionupdate.data sub_48F4F0 information disclosure
MediumCVSS 6.9No exploitEPSS 14%
- Pre-auth
- Info leak
dlink · di-7003g firmwareMay 18, 2025
CVE-2025-23167
26Monitor
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
nodejs · nodeMay 18, 2025
CVE-2025-44108
19Monitor
A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions co
MediumCVSS 4.8Proof of conceptEPSS 0%
- XSS
flatpress · flatpressMay 19, 2025
CVE-2024-33939
21Monitor
WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
themegrill · masteriyoMay 19, 2025
CVE-2025-26892
39Monitor
WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9Proof of conceptEPSS 0%
- File upload
dkszone · celestial auraMay 19, 2025
CVE-2025-39459
29Monitor
WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability
HighCVSS 7.3Proof of conceptEPSS 0%
- Pre-auth
contempoinc · real estate 7May 19, 2025
CVE-2025-47577
41Plan
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 4%
- Pre-auth
- File upload
templateinvaders · ti woocommerce wishlistMay 19, 2025
CVE-2025-39366
35Monitor
WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
rocket apps · wprojectMay 19, 2025
CVE-2025-39401
40Plan
WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- File upload
mojoomla · wpamsMay 19, 2025
CVE-2025-4971
34Monitor
Broadcom Automic Automation Agent Unix privilege escalation
HighCVSS 8.5Proof of conceptEPSS 0%
- Local privilege escalation
broadcom · automic automationMay 19, 2025
CVE-2025-4322
44Plan
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 15%
- Pre-auth
stylemixthemes · motors - car dealer, rental & listing wordpress themeMay 20, 2025
CVE-2025-40634
36Monitor
Stack-based buffer overflow in TP-Link Archer AX50
CriticalCVSS 9.2Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
tp-link · link archer ax50May 20, 2025
CVE-2025-4978
43Plan
Netgear DGND3700 Basic Authentication BRS_top.html improper authentication
CriticalCVSS 9.3No exploitEPSS 21%
- Pre-auth
- Auth bypass
netgear · dgnd3700 firmwareMay 20, 2025
CVE-2025-26086
34Monitor
An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get reque
HighCVSS 7.5No exploitEPSS 14%
- Pre-auth
- Auth bypass
- SQL injection
rsiqueue · management systemMay 20, 2025
CVE-2025-41228
17Monitor
VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
vmware · vcenter serverMay 20, 2025
CVE-2025-37899
31Monitor
ksmbd: fix use-after-free in session logoff
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
linux · linux kernelMay 20, 2025
CVE-2025-37928
31Monitor
dm-bufio: don't schedule in atomic context
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linux kernelMay 20, 2025
CVE-2025-37947
31Monitor
ksmbd: prevent out-of-bounds stream writes by validating *pos
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
linux · linux kernelMay 20, 2025
CVE-2025-44084
45Plan
D-link DI-8100 16.07.26A1 is vulnerable to Command Injection.
CriticalCVSS 9.8No exploitEPSS 21%
- pre-auth RCE
- Command injection
dlink · di-8100g firmwareMay 20, 2025
CVE-2025-37924
38Monitor
ksmbd: fix use-after-free in kerberos authentication
HighCVSS 7.8No exploitEPSS 22%
- Memory safety
linux · linux kernelMay 20, 2025
CVE-2025-4094
44Plan
Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing
CriticalCVSS 9.8Proof of conceptEPSS 16%
- Pre-auth
- Auth bypass
unitedover · digitsMay 21, 2025
CVE-2025-4524
42Plan
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
CriticalCVSS 9.8Proof of conceptEPSS 10%
- pre-auth RCE
- Path traversal
wpstylish · madara – responsive and modern wordpress theme for manga sitesMay 21, 2025
CVE-2025-4611
25Monitor
Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode
MediumCVSS 6.4Proof of conceptEPSS 0%
- XSS
rilwis · slim seo – a fast & automated seo plugin for wordpressMay 21, 2025
CVE-2025-40775
35Monitor
DNS message with invalid TSIG causes an assertion failure
HighCVSS 7.5Proof of conceptEPSS 15%
- Pre-auth
- Denial of service
isc · bind 9May 21, 2025
CVE-2024-56429
30Monitor
itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to t
HighCVSS 7.7Proof of conceptEPSS 0%
- Hard-coded credentials
itech · ilabclientMay 21, 2025
CVE-2025-4008
92Now
Arbitrary Command Injection in Smartbedded MeteoBridge
HighCVSS 8.7KEVWeaponizedEPSS 93%
- pre-auth RCE
- Command injection
smartbedded · meteobridge vmMay 21, 2025
CVE-2024-56428
22Monitor
The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for th
MediumCVSS 5.5Proof of conceptEPSS 0%
itech-gmbh · ilabclientMay 21, 2025
CVE-2025-46822
31Monitor
Unauthenticated Arbitrary File Read via Absolute Path
HighCVSS 7.7Proof of conceptEPSS 4%
- Pre-auth
- Path traversal
osamataher · java-springboot-codebaseMay 21, 2025
CVE-2025-48060
30Monitor
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
HighCVSS 7.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
jqlang · jqMay 21, 2025
CVE-2025-27558
36Monitor
IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks.
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
May 21, 2025
CVE-2025-34026
91Now
Versa Concerto Actuator Authentication Bypass Information Leak
CriticalCVSS 9.2KEVWeaponizedEPSS 81%
- Pre-auth
- Auth bypass
versa-networks · concertoMay 21, 2025
CVE-2025-34027
54Plan
Versa Concerto Authentication Bypass File Write Remote Code Execution
CriticalCVSS 10.0Proof of conceptEPSS 46%
- pre-auth RCE
- Auth bypass
- Race condition
versa-networks · concertoMay 21, 2025
CVE-2025-47947
30Monitor
ModSecurity Has Possible DoS Vulnerability
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
trustwave · modsecurityMay 21, 2025
CVE-2025-4123
53Plan
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.
MediumCVSS 6.1Proof of conceptEPSS 97%
- pre-auth RCE
- SSRF
- Path traversal
- XSS
grafana · grafanaMay 22, 2025
CVE-2025-3937
39Monitor
Use of Password Hash with Insufficient Computational Effort
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3943
33Monitor
Use of GET Request Method With sensitive Query Strings
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-32813
41Plan
An issue was discovered in Infoblox NETMRI before 7.6.1.
HighCVSS 7.2Proof of conceptEPSS 43%
- RCE
- Command injection
infoblox · netmriMay 22, 2025
CVE-2025-32814
50Plan
An issue was discovered in Infoblox NETMRI before 7.6.1.
CriticalCVSS 9.8Proof of conceptEPSS 35%
- Pre-auth
- SQL injection
infoblox · netmriMay 22, 2025
CVE-2025-32815
38Monitor
An issue was discovered in Infoblox NETMRI before 7.6.1.
MediumCVSS 6.5Proof of conceptEPSS 39%
- Pre-auth
- Auth bypass
- Hard-coded credentials
infoblox · netmriMay 22, 2025
CVE-2024-52874
38Monitor
In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks.
HighCVSS 8.8No exploitEPSS 10%
- SQL injection
infoblox · netmriMay 22, 2025
CVE-2024-13946
28Monitor
Binary Planting / LoadLibrary DLL's not Signed
HighCVSS 7.1Proof of conceptEPSS 1%
abb · aspect-enterpriseMay 22, 2025
CVE-2025-47181
35Monitor
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Local privilege escalation
microsoft · edge updateMay 22, 2025
CVE-2025-48708
13Monitor
gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case.
LowCVSS 3.3Proof of conceptEPSS 0%
artifex · ghostscriptMay 23, 2025
CVE-2025-36527
44Plan
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.
HighCVSS 8.3No exploitEPSS 38%
- SQL injection
zohocorp · manageengine adaudit plusMay 23, 2025
CVE-2025-47539
47Plan
WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 25%
- Pre-auth
themewinter · eventinMay 23, 2025
CVE-2025-47646
46Plan
WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 24%
- Pre-auth
gilblas ngunte possi · psw front-end login & registrationMay 23, 2025
CVE-2025-32794
33Monitor
OpenEMR Stored XSS via Patient Name Field in Procedure Orders
HighCVSS 7.6No exploitEPSS 10%
- XSS
open-emr · openemrMay 23, 2025
CVE-2025-32967
21Monitor
OpenEMR doesn't log password administration properly
MediumCVSS 5.4No exploitEPSS 0%
open-emr · openemrMay 23, 2025
CVE-2025-43860
35Monitor
OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics
HighCVSS 7.6No exploitEPSS 15%
- XSS
open-emr · openemrMay 23, 2025
CVE-2025-44998
24Monitor
A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execut
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
prasathmani · tiny file managerMay 23, 2025
CVE-2025-4336
39Monitor
eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
- Hard-coded credentials
emagicone · emagicone store manager for woocommerceMay 24, 2025
CVE-2025-4602
30Monitor
eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
- Hard-coded credentials
emagicone · emagicone store manager for woocommerceMay 24, 2025
CVE-2025-4603
36Monitor
eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion
CriticalCVSS 9.1Proof of conceptEPSS 1%
- pre-auth RCE
- Path traversal
- Hard-coded credentials
emagicone · emagicone store manager for woocommerceMay 24, 2025
CVE-2025-5058
39Monitor
eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
- Hard-coded credentials
emagicone · emagicone store manager for woocommerceMay 24, 2025
CVE-2025-5154
7Monitor
PhonePe App SQLite Database databases cleartext storage in file
LowCVSS 1.8Proof of conceptEPSS 0%
phonepe · phonepeMay 25, 2025
CVE-2025-5182
21Monitor
Summer Pearl Group Vacation Rental Management Platform Listing authorization
MediumCVSS 5.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
summerpearlgroup · vacation rental management platformMay 26, 2025
CVE-2025-5196
30Monitor
Wing FTP Server Lua Admin Console unnecessary privileges
HighCVSS 7.5Proof of conceptEPSS 1%
wftpserver · wing ftp serverMay 26, 2025
CVE-2025-48827
62This week
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running
CriticalCVSS 9.8WeaponizedEPSS 75%
- Pre-auth
vbulletin · vbulletinMay 27, 2025
CVE-2025-48828
60This week
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.
HighCVSS 8.1WeaponizedEPSS 57%
- pre-auth RCE
vbulletin · vbulletinMay 27, 2025
CVE-2025-23247
31Monitor
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coul
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
nvidia · cuda toolkitMay 27, 2025
CVE-2025-46173
24Monitor
code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
code-projects · online exam mastering systemMay 27, 2025
CVE-2025-32440
39Monitor
NetAlertX Vulnerable to Authentication Bypass
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
netalertx · netalertxMay 27, 2025
CVE-2025-5222
28Monitor
Icu: stack buffer overflow in the srbroot::addtag function
HighCVSS 7.0Proof of conceptEPSS 0%
- RCE
- Memory safety
unicode · international components for unicodeMay 27, 2025
CVE-2025-4009
58Plan
Unauthenticated Arbitrary Command Injection in Evertz SDVN
CriticalCVSS 9.3Proof of conceptEPSS 71%
- pre-auth RCE
- Auth bypass
- Command injection
evertz · 3080ipx-10gMay 28, 2025
CVE-2025-5025
19Monitor
No QUIC certificate pinning with wolfSSL
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
haxx · curlMay 28, 2025