Skip to content
OpenAdvisories

Archive

April 2025

Vulnerabilities first published in this month (UTC), newest first.

← March 2025 2025 / April May 2025 →
  1. 1429
  2. 2110
  3. 3177
  4. 4232
  5. 532
  6. 629
  7. 7172
  8. 8349
  9. 9196
  10. 10111
  11. 11127
  12. 1216
  13. 1315
  14. 1486
  15. 15264
  16. 16373
  17. 17314
  18. 18102
  19. 1936
  20. 2025
  21. 2145
  22. 22113
  23. 2379
  24. 24174
  25. 2579
  26. 2622
  27. 2760
  28. 2889
  29. 2993
  30. 30111
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.1
    CVE-2025-3935 Exploited

    ScreenConnect Exposure to ASP.NET ViewState Code Injection

    ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys.  It is important to note …

    ConnectWise ScreenConnect
    KEV Jun 2, 2025
  • High 8.8
    CVE-2025-3928 Exploited

    Commvault Web Server unspecified vulnerability

    Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.4…

    Commvault Web Server
    KEV Apr 28, 2025
  • Critical 10.0
    CVE-2025-32432 Exploited Public exploit Scanner template EPSS 100%

    Craft CMS Allows Remote Code Execution

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. …

    craftcms cms craftcms/cms Packagist
    KEV Mar 20, 2026
  • Critical 10.0
    CVE-2025-31324 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…

    SAP SAP NetWeaver (Visual Composer development server)
    KEV Apr 29, 2025
  • High 8.6
    CVE-2025-1976 Exploited

    Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6

    Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.

    Brocade Fabric OS
    KEV Apr 28, 2025
  • Critical 9.3
    CVE-2025-34028 Exploited Public exploit Scanner template EPSS 98%

    Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

    The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Executi…

    Commvault Command Center Innovation Release
    KEV May 2, 2025
  • Critical 9.8
    CVE-2025-42599 Exploited

    Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a s…

    QUALITIA Active! mail 6
    KEV Apr 28, 2025
  • Critical 10.0
    CVE-2025-32433 Exploited Public exploit EPSS 99%

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoc…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux Alpine
    KEV Jun 9, 2025
  • Critical 9.8
    CVE-2025-31201 Exploited EPSS 14%

    This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Se…

    Apple macOS iOS and iPadOS tvOS macOS iOS
    KEV Apr 17, 2025
  • Critical 9.8
    CVE-2025-31200 Exploited Public exploit EPSS 21%

    A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
    KEV Apr 17, 2025
  • Critical 9.0
    CVE-2024-58136 Exploited Scanner template EPSS 88%

    yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

    Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

    yiiframework Yii yiisoft/yii2 Packagist
    KEV May 2, 2025
  • High 7.8
    CVE-2025-29824 Exploited · Ransomware Public exploit EPSS 19%

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 8, 2025
  • Critical 9.8
    CVE-2025-3248 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

    Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

    langflow-ai langflow langflow langflow-base PyPI
    KEV May 5, 2025
  • Critical 9.0
    CVE-2025-22457 Exploited · Ransomware Public exploit EPSS 100%

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.…

    ivanti Connect Secure Policy Secure Neurons for ZTA gateways Network devices
    KEV Apr 4, 2025
  • Critical 9.8
    CVE-2025-31161 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unl…

    CrushFTP CrushFTP
    KEV Apr 7, 2025
  • Critical 9.0
    CVE-2025-30406 Exploited Public exploit Scanner template EPSS 95%

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to th…

    Gladinet CentreStack
    KEV Apr 8, 2025