Multiple vulnerabilities were reported in April 2025 affecting various vendors and products. Apple macOS had a memory corruption issue, potentially leading to code execution via malicious audio files. The WordPress Smart Product Review plugin was vulnerable to arbitrary file uploads, enabling remote code execution. Several Linux kernel vulnerabilities related to use-after-free bugs were addressed. EPC AI Hub, JoomSky JS Job Manager, and several other products had unrestricted file upload vulnerabilities, often enabling web shell uploads and remote code execution. Erlang/OTP had an SSH server flaw allowing unauthenticated remote code execution. Seclore had an authentication bypass vulnerability, while Wallos had file upload issues in backup/restore functionalities. Hitachi Vantara Pentaho Data Integration & Analytics had a JNDI injection vulnerability. Several vulnerabilities related to SQL injection, buffer overflows, and insecure default settings were also reported across various products, impacting areas like authentication, data manipulation, and remote code execution.