Skip to content
OpenAdvisories

Archive

March 2025

Vulnerabilities first published in this month (UTC), newest first.

← February 2025 2025 / March April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

4,039 results · Feed

  • Medium 4.7
    CVE-2025-24240

    A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7…

    Apple macOS macOS
  • Critical 9.8
    CVE-2025-24241

    A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sono…

    Apple macOS macOS
  • Low 2.4
    CVE-2025-30469

    This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4. A person w…

    Apple iOS and iPadOS iOS
  • High 7.6
    CVE-2025-24095

    This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS …

    Apple iOS and iPadOS visionOS iOS
  • Medium 4.3
    CVE-2025-24216

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iP…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  • Medium 5.5
    CVE-2025-24191

    The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. A…

    Apple macOS macOS
  • Medium 5.4
    CVE-2025-30428

    This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.…

    Apple iOS and iPadOS iPadOS iOS
  • High 7.1
    CVE-2025-24257 Public exploit

    An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 1…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.8
    CVE-2025-31184

    This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers
  • Medium 5.5
    CVE-2025-24282

    A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app…

    Apple macOS macOS
  • Medium 6.7
    CVE-2025-31192

    The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequo…

    Apple macOS iOS and iPadOS Safari macOS iOS Browsers
  • Medium 5.5
    CVE-2025-24164

    A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS…

    Apple macOS macOS
  • Medium 6.4
    CVE-2025-30432

    A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.8
    CVE-2025-30465

    A permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, m…

    Apple macOS iPadOS macOS iOS
  • Critical 9.8
    CVE-2025-30424

    A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.…

    Apple macOS macOS
  • Critical 9.8
    CVE-2025-24172

    A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macO…

    Apple macOS macOS
  • High 7.8
    CVE-2025-31188

    A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7…

    Apple macOS macOS
  • High 7.8
    CVE-2025-24277

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …

    Apple macOS macOS
  • Medium 6.6
    CVE-2025-3062

    Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010

    Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.

    Drupal Drupal Admin LTE theme drupal/druadmin_lte_theme Web / CMS Packagist
  • Medium 5.5
    CVE-2025-24261

    The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ven…

    Apple macOS macOS
  • Medium 5.5
    CVE-2025-24148

    This issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS S…

    Apple macOS macOS
  • Medium 5.5
    CVE-2025-24236

    An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS So…

    Apple macOS macOS
  • High 7.8
    CVE-2025-30449

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…

    Apple macOS macOS
  • Medium 6.6
    CVE-2025-3061

    Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

    Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.

    Drupal Material Admin drupal/material_admin Packagist
  • Medium 6.6
    CVE-2025-3060

    Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005

    Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.

    Drupal Flattern – Multipurpose Bootstrap Business Profile
  • Medium 5.3
    CVE-2025-3059

    Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002

    Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.

    Drupal Profile Private drupal/profile_private Packagist
  • Low 2.4
    CVE-2025-3036

    yzk2356911358 StudentServlet-JSP Student Management cross site scripting

    A vulnerability, which was classified as problematic, was found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b21820f991. This affects an unknown part of the component Student Management Handler. Th…

    yzk2356911358 StudentServlet-JSP
  • Medium 6.3
    CVE-2025-3018

    SourceCodester Online Eyewear Shop Users.php sql injection

    A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID leads to sql injection. It is possible to laun…

    SourceCodester Online Eyewear Shop
  • Medium 6.1
    CVE-2025-31697

    Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.

    Drupal Formatter Suite drupal/formatter_suite Packagist
  • Medium 6.1
    CVE-2025-31696

    RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.

    Drupal RapiDoc OAS Field Formatter drupal/rapidoc_elements_field_formatter Packagist
  • Medium 6.1
    CVE-2025-31695

    Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.

    Drupal Link field display mode formatter drupal/link_field_display_mode_formatter Packagist
  • High 8.1
    CVE-2025-31694

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

    Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 6.6
    CVE-2025-31693

    AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.1
    CVE-2025-26683

    Azure Playwright Elevation of Privilege Vulnerability

    Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Playwright
  • High 7.5
    CVE-2025-31692

    AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Critical 9.8
    CVE-2025-31691

    OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020

    Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.

    Drupal OAuth2 Server drupal/oauth2_server Packagist
  • High 8.8
    CVE-2025-31690

    Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.

    Drupal Cache Utility drupal/cache_utility Packagist
  • High 8.1
    CVE-2025-31689

    General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

    Drupal General Data Protection Regulation drupal/gdpr Packagist
  • Medium 6.8
    CVE-2025-31688

    Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.

    Drupal Configuration Split drupal/config_split Packagist
  • Medium 6.1
    CVE-2025-31687

    SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

    Drupal SpamSpan filter drupal/spamspan Packagist