Skip to content
OpenAdvisories

Archive

March 2025

Vulnerabilities first published in this month (UTC), newest first.

← February 2025 2025 / March April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

1,515 results · Clear filters · Feed

  • High 8.8
    CVE-2025-24254

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma …

    Apple macOS macOS
  • High 8.4
    CVE-2025-24255

    A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sono…

    Apple macOS macOS
  • High 7.8
    CVE-2025-24243

    The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, …

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.8
    CVE-2025-24234

    This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.…

    Apple macOS macOS
  • High 7.8
    CVE-2025-24170

    A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5…

    Apple macOS macOS
  • High 7.5
    CVE-2025-30471

    A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, m…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.8
    CVE-2025-24213

    This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  • High 7.8
    CVE-2025-30456 Public exploit

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …

    Apple macOS iOS and iPadOS macOS iOS
  • High 7.4
    CVE-2025-24229

    A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS…

    Apple macOS macOS
  • High 7.4
    CVE-2025-30437

    The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to c…

    Apple macOS macOS
  • High 7.4
    CVE-2025-30460

    A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macO…

    Apple macOS macOS
  • High 7.0
    CVE-2025-24209

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and i…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  • High 7.0
    CVE-2024-54533

    A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macO…

    Apple macOS macOS
  • High 7.8
    CVE-2025-24228

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS S…

    Apple macOS macOS
  • High 8.8
    CVE-2025-24196

    A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS So…

    Apple macOS macOS
  • High 8.1
    CVE-2025-24180

    The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, m…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers
  • High 7.8
    CVE-2025-24267

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…

    Apple macOS macOS
  • High 7.5
    CVE-2025-24221

    This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS…

    Apple iOS and iPadOS visionOS iPadOS iOS
  • High 7.8
    CVE-2025-24173

    This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.8
    CVE-2025-30464

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, ma…

    Apple macOS macOS
  • High 7.6
    CVE-2025-24095

    This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS …

    Apple iOS and iPadOS visionOS iOS
  • High 7.1
    CVE-2025-24257 Public exploit

    An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 1…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.8
    CVE-2025-31184

    This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers
  • High 7.8
    CVE-2025-31188

    A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7…

    Apple macOS macOS
  • High 7.8
    CVE-2025-24277

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …

    Apple macOS macOS
  • High 7.8
    CVE-2025-30449

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…

    Apple macOS macOS
  • High 8.1
    CVE-2025-31694

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

    Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • High 8.1
    CVE-2025-26683

    Azure Playwright Elevation of Privilege Vulnerability

    Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Playwright
  • High 7.5
    CVE-2025-31692

    AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31690

    Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.

    Drupal Cache Utility drupal/cache_utility Packagist
  • High 8.1
    CVE-2025-31689

    General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

    Drupal General Data Protection Regulation drupal/gdpr Packagist
  • High 8.1
    CVE-2025-31686

    Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • High 8.2
    CVE-2025-31678

    AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31677

    AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31676

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

    Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

    Drupal Email TFA drupal/email_tfa Packagist
  • High 7.5
    CVE-2025-31674

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • High 7.8
    CVE-2025-21893

    keys: Fix UAF in key_put()

    In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.7
    CVE-2025-31123

    Zitadel Expired JWT Keys Usable for Authorization Grants

    Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allow…

    zitadel zitadel
  • High 8.8
    CVE-2025-31129 Public exploit

    jooby-pac4j: deserialization of untrusted data

    Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).

    jooby-project jooby io.jooby:jooby-pac4j Maven
  • High 7.3
    CVE-2025-3006

    PHPGurukul e-Diary Management System edit-category.php sql injection

    A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /edit-category.php?id=8. The manipulation of the argument Category leads to sql injection. The attack …

    PHPGurukul e-Diary Management System