Skip to content
OpenAdvisories

Archive

April 2025

Vulnerabilities first published in this month (UTC), newest first.

← March 2025 2025 / April May 2025 →
  1. 1429
  2. 2110
  3. 3177
  4. 4232
  5. 532
  6. 629
  7. 7172
  8. 8349
  9. 9196
  10. 10111
  11. 11127
  12. 1216
  13. 1315
  14. 1486
  15. 15264
  16. 16373
  17. 17314
  18. 18102
  19. 1936
  20. 2025
  21. 2145
  22. 22113
  23. 2379
  24. 24174
  25. 2579
  26. 2622
  27. 2760
  28. 2889
  29. 2993
  30. 30111
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-32432 Exploited Public exploit Scanner template EPSS 100%

    Craft CMS Allows Remote Code Execution

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. …

    craftcms cms craftcms/cms Packagist
    KEV Mar 20, 2026
  • Critical 10.0
    CVE-2025-31324 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…

    SAP SAP NetWeaver (Visual Composer development server)
    KEV Apr 29, 2025
  • Critical 9.3
    CVE-2025-34028 Exploited Public exploit Scanner template EPSS 98%

    Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

    The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Executi…

    Commvault Command Center Innovation Release
    KEV May 2, 2025
  • Critical 10.0
    CVE-2025-32433 Exploited Public exploit EPSS 99%

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoc…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux Alpine
    KEV Jun 9, 2025
  • Critical 9.8
    CVE-2025-31200 Exploited Public exploit EPSS 21%

    A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
    KEV Apr 17, 2025
  • High 7.8
    CVE-2025-29824 Exploited · Ransomware Public exploit EPSS 19%

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Apr 8, 2025
  • Critical 9.8
    CVE-2025-3248 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

    Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

    langflow-ai langflow langflow langflow-base PyPI
    KEV May 5, 2025
  • Critical 9.0
    CVE-2025-22457 Exploited · Ransomware Public exploit EPSS 100%

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.…

    ivanti Connect Secure Policy Secure Neurons for ZTA gateways Network devices
    KEV Apr 4, 2025
  • Critical 9.8
    CVE-2025-31161 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unl…

    CrushFTP CrushFTP
    KEV Apr 7, 2025
  • Critical 9.0
    CVE-2025-30406 Exploited Public exploit Scanner template EPSS 95%

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to th…

    Gladinet CentreStack
    KEV Apr 8, 2025