İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2025: sömürülen ve yeni ciddi CVE kayıtları

186 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 2

  • CVE-2025-30911
    40Planlayın

    WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %1

    rometheme · rtmkit1 Nis 2025

  • CVE-2025-30065
    53Planlayın

    Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

    KritikCVSS 10,0Kavram kanıtıEPSS %43

    apache · parquet java1 Nis 2025

  • CVE-2024-56325
    63Bu hafta

    Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

    KritikCVSS 9,8Kavram kanıtıEPSS %80

    apache · pinot1 Nis 2025

  • CVE-2025-30676
    44Planlayın

    Apache OFBiz: Stored XSS Vulnerability

    OrtaCVSS 6,1İstismar yokEPSS %67

    apache · ofbiz1 Nis 2025

  • CVE-2025-31121
    33İzleyin

    OpenEMR allows XSS in Patient Image feature

    YüksekCVSS 7,0İstismar yokEPSS %17

    open-emr · openemr1 Nis 2025

  • CVE-2025-31131
    32İzleyin

    Path Traversal allowing arbitrary read of files in Yeswiki

    YüksekCVSS 7,5Kavram kanıtıEPSS %5

    yeswiki · yeswiki1 Nis 2025

  • CVE-2025-31864
    23İzleyin

    WordPress Beam me up Scotty – Back to Top Button plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    out the box · beam me up scotty1 Nis 2025

  • CVE-2025-26054
    21İzleyin

    Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    1 Nis 2025

  • CVE-2025-26055
    26İzleyin

    An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter o

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    1 Nis 2025

  • CVE-2025-26056
    21İzleyin

    A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality.

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    1 Nis 2025

  • CVE-2025-31137
    30İzleyin

    Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    remix-run · react-router1 Nis 2025

  • CVE-2025-3096
    37İzleyin

    Clinics Patient Management System SQL Injection

    KritikCVSS 9,3SilahlaştırılmışEPSS %1

    sourcecodester · clinic's patient management system1 Nis 2025

  • CVE-2003-20001
    22İzleyin

    An issue was discovered on Mitel ICP VoIP 3100 devices.

    OrtaCVSS 5,6Kavram kanıtıEPSS %1

    1 Nis 2025

  • CVE-2023-46988
    26İzleyin

    Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating th

    OrtaCVSS 6,7Kavram kanıtıEPSS %0

    onlyoffice · document server1 Nis 2025

  • CVE-2024-36465
    46Planlayın

    SQL injection in Zabbix API

    YüksekCVSS 8,6İstismar yokEPSS %39

    zabbix · zabbix2 Nis 2025

  • CVE-2025-2005
    46Planlayın

    Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    etoilewebdesign · front end users2 Nis 2025

  • CVE-2025-31722
    35İzleyin

    In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attacker

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    jenkins · templating engine2 Nis 2025

  • CVE-2025-29085
    48Planlayın

    SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/e

    KritikCVSS 9,8Kavram kanıtıEPSS %31

    2 Nis 2025

  • CVE-2025-2945
    52Planlayın

    pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

    YüksekCVSS 8,8SilahlaştırılmışEPSS %56

    pgadmin · pgadmin 43 Nis 2025

  • CVE-2025-31800
    26İzleyin

    WordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    publitio · publitio3 Nis 2025

  • CVE-2025-3155
    33İzleyin

    Yelp: arbitrary file read

    YüksekCVSS 7,4İstismar yokEPSS %13

    gnome · yelp3 Nis 2025

  • CVE-2025-22457
    99Hemen

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    ivanti · connect secure3 Nis 2025

  • CVE-2025-31486
    33İzleyin

    Vite allows server.fs.deny to be bypassed with .svg or relative paths

    OrtaCVSS 5,3Kavram kanıtıEPSS %40

    vitejs · vite3 Nis 2025

  • CVE-2025-30406
    97Hemen

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %94

    gladinet · centrestack3 Nis 2025

  • CVE-2025-31161
    99Hemen

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy insta

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    crushftp · crushftp3 Nis 2025

  • CVE-2025-31489
    35İzleyin

    MinIO performs incomplete signature validation for unsigned-trailer uploads

    YüksekCVSS 8,7Kavram kanıtıEPSS %2

    minio · minio3 Nis 2025

  • CVE-2025-2075
    36İzleyin

    Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    uncannyowl · uncanny automator4 Nis 2025

  • CVE-2025-3194
    30İzleyin

    Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function.

    YüksekCVSS 7,7Kavram kanıtıEPSS %0

    4 Nis 2025

  • CVE-2025-3243
    21İzleyin

    code-projects Patient Record Management System dental_form.php sql injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    code-projects · patient record management system4 Nis 2025

  • CVE-2025-28146
    42Planlayın

    Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url i

    KritikCVSS 9,8İstismar yokEPSS %11

    edimax · br-6478ac v3 firmware4 Nis 2025

  • CVE-2025-27520
    51Planlayın

    BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

    KritikCVSS 9,8SilahlaştırılmışEPSS %40

    bentoml · bentoml4 Nis 2025

  • CVE-2025-32118
    36İzleyin

    WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    niteothemes · cmp – coming soon & maintenance4 Nis 2025

  • CVE-2025-32257
    21İzleyin

    WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    1clickmigration · 1 click wordpress migration4 Nis 2025

  • CVE-2021-47667
    51Planlayın

    An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attacke

    KritikCVSS 10,0İstismar yokEPSS %36

    zend · zendto5 Nis 2025

  • CVE-2025-30401
    32İzleyin

    A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file

    OrtaCVSS 6,7İstismar yokEPSS %20

    whatsapp · whatsapp5 Nis 2025

  • CVE-2025-32370
    39İzleyin

    Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    kentico · xperience6 Nis 2025

  • CVE-2025-32013
    37İzleyin

    Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    lnbits · lnbits6 Nis 2025

  • CVE-2025-3248
    99Hemen

    Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    langflow · langflow7 Nis 2025

  • CVE-2025-2807
    35İzleyin

    Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    stylemixthemes · motors - car dealer\, classifieds \& listing8 Nis 2025

  • CVE-2025-2568
    21İzleyin

    Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    themehunk · vayu blocks – gutenberg blocks for wordpress & woocommerce8 Nis 2025

  • CVE-2024-46671
    28İzleyin

    An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below,

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    fortinet · fortiweb8 Nis 2025

  • CVE-2025-25254
    33İzleyin

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below

    YüksekCVSS 7,2İstismar yokEPSS %17

    fortinet · fortiweb8 Nis 2025

  • CVE-2024-48887
    44Planlayın

    A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin password

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    fortinet · fortiswitch8 Nis 2025

  • CVE-2025-25227
    30İzleyin

    [20250402] - Joomla Core - MFA Authentication Bypass

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    joomla · joomla\!8 Nis 2025

  • CVE-2025-21204
    33İzleyin

    Windows Process Activation Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %6

    microsoft · windows 10 15078 Nis 2025

  • CVE-2025-26670
    35İzleyin

    Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %11

    microsoft · windows 10 15078 Nis 2025

  • CVE-2025-26686
    30İzleyin

    Windows TCP/IP Remote Code Execution Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    microsoft · windows 10 15078 Nis 2025

  • CVE-2025-27480
    36İzleyin

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %12

    microsoft · windows server 20128 Nis 2025

  • CVE-2025-27751
    32İzleyin

    Microsoft Excel Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    microsoft · 365 apps8 Nis 2025

  • CVE-2025-29793
    35İzleyin

    Microsoft SharePoint Remote Code Execution Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %23

    microsoft · sharepoint enterprise server8 Nis 2025

  • CVE-2025-29810
    31İzleyin

    Active Directory Domain Services Elevation of Privilege Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    microsoft · windows 10 15078 Nis 2025

  • CVE-2025-29824
    65Bu hafta

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %13

    microsoft · windows 10 15078 Nis 2025

  • CVE-2025-30281
    43Planlayın

    ColdFusion | Improper Access Control (CWE-284)

    KritikCVSS 9,1İstismar yokEPSS %23

    adobe · coldfusion8 Nis 2025

  • CVE-2025-30285
    42Planlayın

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    YüksekCVSS 8,4İstismar yokEPSS %30

    adobe · coldfusion8 Nis 2025

  • CVE-2025-30290
    40Planlayın

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    YüksekCVSS 8,7İstismar yokEPSS %19

    adobe · coldfusion8 Nis 2025

  • CVE-2025-30292
    29İzleyin

    ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

    OrtaCVSS 6,1İstismar yokEPSS %15

    adobe · coldfusion8 Nis 2025

  • CVE-2025-30294
    32İzleyin

    ColdFusion | Improper Input Validation (CWE-20)

    OrtaCVSS 6,8İstismar yokEPSS %17

    adobe · coldfusion8 Nis 2025

  • CVE-2025-32375
    55Planlayın

    Insecure Deserialization leads to RCE in BentoML's runner server

    KritikCVSS 9,8SilahlaştırılmışEPSS %52

    bentoml · bentoml9 Nis 2025

  • CVE-2025-31033
    39İzleyin

    WordPress Buddypress Humanity plugin <= 1.2 - CSRF to Privilege Escalation vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    adam nowak · buddypress humanity9 Nis 2025

  • CVE-2025-32641
    38İzleyin

    WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    anantaddons · anant addons for elementor9 Nis 2025

  • CVE-2025-29018
    19İzleyin

    A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking Syst

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    codeastro · internet banking system9 Nis 2025

  • CVE-2024-58136
    95Hemen

    Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87

    yiiframework · yii9 Nis 2025

  • CVE-2025-3102
    55Planlayın

    SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

    YüksekCVSS 8,1SilahlaştırılmışEPSS %76

    brainstormforce · ottokit: all-in-one automation platform10 Nis 2025

  • CVE-2025-32140
    39İzleyin

    WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    nirmal kumar ram · wp remote thumbnail10 Nis 2025

  • CVE-2025-32206
    36İzleyin

    WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    labcat · processing projects10 Nis 2025

  • CVE-2025-32259
    21İzleyin

    WordPress WP ULike plugin <= 4.7.9.1 - Content Spoofing Vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    alimir · wp ulike10 Nis 2025

  • CVE-2025-29017
    35İzleyin

    A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    codeastro · internet banking system10 Nis 2025

  • CVE-2025-32395
    25İzleyin

    Vite has an `server.fs.deny` bypass with an invalid `request-target`

    OrtaCVSS 6,0Kavram kanıtıEPSS %1

    vitejs · vite10 Nis 2025

  • CVE-2025-2636
    35İzleyin

    InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion

    YüksekCVSS 8,1Kavram kanıtıEPSS %10

    instawp · instawp connect – 1-click wp staging & migration11 Nis 2025

  • CVE-2025-32579
    39İzleyin

    WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    softclever limited · sync posts11 Nis 2025

  • CVE-2025-32614
    36İzleyin

    WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    ashan perera · eventon11 Nis 2025

  • CVE-2025-3538
    38İzleyin

    D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow

    YüksekCVSS 8,7İstismar yokEPSS %13

    dlink · di-8100 firmware13 Nis 2025

  • CVE-2025-2563
    47Planlayın

    User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation

    YüksekCVSS 8,1SilahlaştırılmışEPSS %48

    wpeverest · user registration \& membership14 Nis 2025

  • CVE-2025-3568
    20İzleyin

    Webkul Krayin CRM SVG File edit cross site scripting

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    webkul · krayin crm14 Nis 2025

  • CVE-2025-24797
    39İzleyin

    Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    meshtastic · meshtastic firmware14 Nis 2025

  • CVE-2024-45712
    21İzleyin

    SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    solarwinds · serv-u15 Nis 2025

  • CVE-2025-32103
    25İzleyin

    CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files ac

    OrtaCVSS 5,0İstismar yokEPSS %18

    crushftp · crushftp15 Nis 2025

  • CVE-2025-28137
    49Planlayın

    The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg funct

    KritikCVSS 9,8İstismar yokEPSS %34

    totolink · a810r firmware15 Nis 2025

  • CVE-2024-36842
    29İzleyin

    An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Numbe

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    15 Nis 2025

  • CVE-2021-27289
    36İzleyin

    A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor =

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    15 Nis 2025

  • CVE-2025-29705
    17İzleyin

    code-gen <=2.0.6 is vulnerable to Incorrect Access Control.

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    tanghc · code-gen15 Nis 2025

  • CVE-2025-1122
    26İzleyin

    Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to ga

    OrtaCVSS 6,7Kavram kanıtıEPSS %0

    google · chrome15 Nis 2025

  • CVE-2025-21574
    26İzleyin

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    oracle · mysql cluster15 Nis 2025

  • CVE-2025-30712
    32İzleyin

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    oracle · vm virtualbox15 Nis 2025

  • CVE-2025-32778
    43Planlayın

    Web-Check allows command Injection via Unvalidated URL in Screenshot API

    KritikCVSS 9,3SilahlaştırılmışEPSS %19

    lissy93 · web-check15 Nis 2025

  • CVE-2025-27892
    31İzleyin

    Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.

    OrtaCVSS 6,8Kavram kanıtıEPSS %12

    shopware · shopware15 Nis 2025

  • CVE-2025-29471
    35İzleyin

    Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into t

    YüksekCVSS 8,3Kavram kanıtıEPSS %7

    nagios · log server15 Nis 2025

  • CVE-2025-30967
    38İzleyin

    WordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    notfound · wpjobboard15 Nis 2025

  • CVE-2025-3663
    30İzleyin

    TOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control

    OrtaCVSS 6,9İstismar yokEPSS %11

    totolink · a3700r firmware15 Nis 2025

  • CVE-2025-39538
    26İzleyin

    WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability

    OrtaCVSS 6,6Kavram kanıtıEPSS %0

    mathieu chartier · wp-advanced-search16 Nis 2025

  • CVE-2025-39601
    38İzleyin

    WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    wpfactory · custom css, js & php16 Nis 2025

  • CVE-2025-23134
    22İzleyin

    ALSA: timer: Don't take register_mutex with copy_from/to_user()

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    linux · linux kernel16 Nis 2025

  • CVE-2025-31200
    75Bu hafta

    A memory corruption issue was addressed with improved bounds checking.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %20

    apple · macos16 Nis 2025

  • CVE-2025-31201
    73Bu hafta

    This issue was addressed by removing the vulnerable code.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %13

    apple · macos16 Nis 2025

  • CVE-2025-22037
    51Planlayın

    ksmbd: fix null pointer dereference in alloc_preauth_hash()

    YüksekCVSS 7,5İstismar yokEPSS %69

    linux · linux kernel16 Nis 2025

  • CVE-2025-26153
    21İzleyin

    A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    16 Nis 2025

  • CVE-2025-32433
    100Hemen

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %98

    erlang · erlang\/otp16 Nis 2025

  • CVE-2025-29015
    24İzleyin

    Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    codeastro · internet banking system17 Nis 2025

  • CVE-2025-24752
    24İzleyin

    WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    wpdeveloper · essential addons for elementor17 Nis 2025

  • CVE-2025-32583
    45Planlayın

    WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %20

    termel · pdf 2 post17 Nis 2025