Skip to content
OpenAdvisories

Archive

31 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /31 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.0
    CVE-2025-24203 Public exploit

    The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Seq…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.8
    CVE-2025-30456 Public exploit

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …

    Apple macOS iOS and iPadOS macOS iOS
  • Critical 9.8
    CVE-2025-24204 Public exploit

    The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access p…

    Apple macOS macOS
  • High 7.1
    CVE-2025-24257 Public exploit

    An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 1…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 8.8
    CVE-2025-31129 Public exploit

    jooby-pac4j: deserialization of untrusted data

    Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).

    jooby-project jooby io.jooby:jooby-pac4j Maven
  • Medium 5.3
    CVE-2025-31125 Exploited Public exploit Scanner template EPSS 75%

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…

    vitejs vite vite npm
    KEV Jan 22, 2026
  • High 8.3
    CVE-2025-30005 Public exploit

    Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion

    Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report. This issue affects CompletePBX: all versions up …

    Xorcom CompletePBX
  • High 8.8
    CVE-2025-30004 Public exploit

    Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection

    Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35

    Xorcom CompletePBX
  • Medium 6.5
    CVE-2025-2292 Public exploit

    Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure

    Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.

    Xorcom CompletePBX
  • Medium 6.5
    CVE-2025-3047 Public exploit

    Path Traversal in AWS SAM CLI allows file copy to build container

    When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevate…

    AWS AWS Serverless Application Model Command Line Interface aws-sam-cli PyPI
  • Medium 5.3
    CVE-2025-2995 Public exploit

    Tenda FH1202 Web Management Interface SysToolChangePwd access control

    A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects unknown code of the file /goform/SysToolChangePwd of the component Web Management Interface. The manipulation leads to improper access controls…

    Tenda FH1202