Skip to content
OpenAdvisories

Archive

March 2025

Vulnerabilities first published in this month (UTC), newest first.

← February 2025 2025 / March April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

57 results · Clear filters · Feed

  • High 8.1
    CVE-2025-24035 Public exploit

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 8.1
    CVE-2025-27363 Exploited Public exploit EPSS 28%

    An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…

    FreeType FreeType freetype freetype Debian Ubuntu Azure Linux Alpine
    KEV May 6, 2025
  • High 7.3
    CVE-2025-1550 Public exploit

    Arbitrary Code Execution via Crafted Keras Config for Model Loading

    The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and…

    Google Keras kubeflow-pipelines-visualization-server keras Ubuntu Azure Linux Wolfi PyPI
  • High 7.3
    CVE-2025-25748 Public exploit

    A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized a…

    hoteldruid hoteldruid Debian Ubuntu
  • High 7.1
    CVE-2025-25749 Public exploit

    An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of p…

    hoteldruid hoteldruid Debian Ubuntu
  • High 8.8
    CVE-2025-2135 Public exploit

    Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corr…

    Google Chrome chromium chromium Browsers Debian Azure Linux Wolfi
  • High 8.8
    CVE-2025-25614 Public exploit

    Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the per…

  • High 7.6
    CVE-2025-25616 Public exploit

    Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The af…

  • High 7.5
    CVE-2025-1323 Public exploit Scanner template

    WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection

    The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of suff…

    wppost WP-Recall – Registration, Profile, Commerce & More Web / CMS
  • High 8.8
    CVE-2025-27607 Public exploit

    Python JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependency

    Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name o…

    nhairs python-json-logger python-pythonjsonlogger Ubuntu
  • High 7.7
    CVE-2025-27152 Public exploit

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

    axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  • High 7.1
    CVE-2024-10930 Public exploit

    Carrier Block Load Privilege Escalation

    An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.

    Carrier Block Load
  • High 8.8
    CVE-2025-1306 Public exploit

    Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible f…

    spicethemes Newscrunch Web / CMS
  • High 8.8
    CVE-2025-1639 Public exploit

    Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes …

    crowdyTheme Animation Addons for Elementor Pro Web / CMS
  • High 8.6
    CVE-2024-48248 Exploited Public exploit Scanner template EPSS 94%

    NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to …

    NAKIVO Backup & Replication Director
    KEV Mar 19, 2025
  • High 7.8
    CVE-2025-0288 Public exploit

    CVE-2025-0288

    Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel …

    Paragon Software Hard Disk Manager Migrate OS to SSD Backup and Recovery
  • High 7.5
    CVE-2024-53027 Public exploit

    Buffer Copy Without Checking Size of Input in WLAN Host

    Transient DOS may occur while processing the country IE.

    Qualcomm Snapdragon