Skip to content
OpenAdvisories

Archive

13 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /13 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-43564 Public exploit EPSS 17%

    ColdFusion | Incorrect Authorization (CWE-863)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data …

    Adobe ColdFusion
  • High 8.7
    CVE-2025-4660 Public exploit

    Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access

    A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based a…

    Forescout SecureConnector
  • High 7.5
    CVE-2025-30397 Exploited Public exploit EPSS 27%

    Scripting Engine Memory Corruption Vulnerability

    Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV May 13, 2025
  • High 7.8
    CVE-2025-32709 Exploited Public exploit

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV May 13, 2025
  • High 7.8
    CVE-2025-30400 Exploited Public exploit

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV May 13, 2025
  • High 7.5
    CVE-2025-29969 Public exploit

    MS-EVEN RPC Remote Code Execution Vulnerability

    Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.2
    CVE-2025-4428 Exploited Public exploit EPSS 88%

    Remote Code Execution

    Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

    ivanti Endpoint Manager Mobile Network devices
    KEV May 19, 2025
  • Medium 5.3
    CVE-2025-4427 Exploited Public exploit Scanner template EPSS 100%

    Authentication Bypass

    An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

    ivanti Endpoint Manager Mobile Network devices
    KEV May 19, 2025
  • Medium 6.0
    CVE-2025-46721 Public exploit

    nosurf vulnerable to CSRF due to non-functional same-origin request checks

    nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF…

    justinas nosurf github.com/justinas/nosurf Go
  • Critical 9.6
    CVE-2025-32756 Exploited Public exploit EPSS 31%

    A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiC…

    Fortinet FortiMail FortiVoice FortiRecorder Network devices
    KEV May 14, 2025
  • Critical 9.8
    CVE-2025-4632 Exploited Public exploit Scanner template EPSS 24%

    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before …

    Samsung Electronics MagicINFO 9 Server
    KEV May 22, 2025
  • High 7.5
    CVE-2025-4396 Public exploit Scanner template

    Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection

    The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.5 (Premium) due to insufficient escaping on the user supplie…

    comesio Relevanssi Relevanssi – A Better Search Relevanssi Premium Web / CMS
  • High 8.6
    CVE-2024-48766 Public exploit Scanner template EPSS 68%

    NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and…

    NetAlertX NetAlertX
  • Critical 10.0
    CVE-2024-46506 Public exploit Scanner template EPSS 63%

    NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because fu…

    NetAlertX NetAlertX
  • Medium 5.1
    CVE-2025-44039 Public exploit

    CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console.…