Skip to content
OpenAdvisories

Archive

March 2025

Vulnerabilities first published in this month (UTC), newest first.

← February 2025 2025 / March April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

138 results · Clear filters · Feed

  • Medium 5.4
    CVE-2024-48246 Public exploit

    Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /ve…

  • High 7.1
    CVE-2024-10930 Public exploit

    Carrier Block Load Privilege Escalation

    An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.

    Carrier Block Load
  • High 7.1
    CVE-2025-22226 Exploited Public exploit

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HG…

    Virtualization
    KEV Mar 4, 2025
  • Critical 9.3
    CVE-2025-22224 Exploited Public exploit

    VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds …

    VMware Workstation ESXi Telco Cloud Platform Virtualization
    KEV Mar 4, 2025
  • Critical 9.8
    CVE-2025-1307 Public exploit

    Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attac…

    spicethemes Newscrunch Web / CMS
  • High 8.8
    CVE-2025-1306 Public exploit

    Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible f…

    spicethemes Newscrunch Web / CMS
  • High 8.8
    CVE-2025-1639 Public exploit

    Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes …

    crowdyTheme Animation Addons for Elementor Pro Web / CMS
  • High 8.6
    CVE-2024-48248 Exploited Public exploit Scanner template EPSS 94%

    NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to …

    NAKIVO Backup & Replication Director
    KEV Mar 19, 2025
  • Medium 4.3
    CVE-2025-26202 Public exploit

    Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4…

  • Critical 9.8
    CVE-2025-26319 Public exploit Scanner template EPSS 56%

    FlowiseAI Flowise arbitrary file upload vulnerability

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    flowise npm
  • Medium 5.8
    CVE-2025-26318 Public exploit

    hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain account…

    TSplus TSplus Remote Access
  • High 7.8
    CVE-2025-0288 Public exploit

    CVE-2025-0288

    Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel …

    Paragon Software Disk Wiper Hard Disk Manager Migrate OS to SSD
  • Medium 6.9
    CVE-2025-1868 Public exploit

    Information display on multiple products from Famatech Corp

    Vulnerability of unauthorized exposure of confidential information affecting Advanced IP Scanner and Advanced Port Scanner. It occurs when these applications initiate a network scan, inadvertently sending the NTLM hash of the user performing the scan. This vu…

    Famatech Advanced IP Scanner Advanced Port Scanner
  • High 7.5
    CVE-2024-53027 Public exploit

    Buffer Copy Without Checking Size of Input in WLAN Host

    Transient DOS may occur while processing the country IE.

    Qualcomm Snapdragon
  • Medium 5.1
    CVE-2023-49031 Public exploit

    Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a r…

  • Critical 9.0
    CVE-2025-27590 Public exploit EPSS 28%

    Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

    In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.

    Oxidized Web project Oxidized Web oxidized-web RubyGems
  • Medium 6.8
    CVE-2025-25967 Public exploit

    Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authe…

  • Critical 9.0
    CVE-2025-26206 Public exploit

    Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges …