Skip to content
OpenAdvisories

Archive

12 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /12 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.9
    CVE-2025-0108 Exploited Public exploit Scanner template EPSS 98%

    PAN-OS: Authentication Bypass in the Management Web Interface

    An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certai…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV Feb 18, 2025
  • High 8.2
    CVE-2025-25205 Public exploit

    Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

    Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers ca…

    advplyr audiobookshelf
  • Critical 9.2
    CVE-2025-25200 Public exploit

    Koa has Inefficient Regular Expression Complexity

    Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out …

    koajs koa koa npm
  • High 7.1
    CVE-2025-25198 Public exploit

    mailcow: dockerized vulnerable to password reset poisoning

    mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointin…

    mailcow mailcow-dockerized
  • High 8.1
    CVE-2024-13800 Public exploit

    Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it…

    Brainstorm Force ConvertPlus Web / CMS
  • Medium 6.4
    CVE-2024-54160 Public exploit

    dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because…

    LF Projects OpenSearch