Skip to content
OpenAdvisories

Archive

23 April 2025

Vulnerabilities first published on this day (UTC), newest first.

← March 2025 2025 / April /23 May 2025 →
  1. 1429
  2. 2110
  3. 3177
  4. 4232
  5. 532
  6. 629
  7. 7172
  8. 8349
  9. 9196
  10. 10111
  11. 11127
  12. 1216
  13. 1315
  14. 1486
  15. 15264
  16. 16373
  17. 17314
  18. 18102
  19. 1936
  20. 2025
  21. 2145
  22. 22113
  23. 2379
  24. 24174
  25. 2579
  26. 2622
  27. 2760
  28. 2889
  29. 2993
  30. 30111
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-25045

    IBM InfoSphere Information Server information disclosure

    IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system.

    IBM InfoSphere Information Server
  • Medium 6.3
    CVE-2024-22351

    IBM InfoSphere Information Server session fixation

    IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

    IBM InfoSphere Information Server
  • Medium 5.5
    CVE-2025-46400

    Xfig: fig2dev segmentation fault in read_arcobject

    In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Alpine
  • Medium 5.5
    CVE-2025-46399

    Xfig: transfig: fig2dev segmentation fault vulnerability

    A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Alpine
  • Medium 5.5
    CVE-2025-46398

    Xfig: fig2dev stack-overflow via read_objects

    In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Alpine
  • Medium 4.3
    CVE-2025-3907

    Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.

    Drupal Search API Solr drupal/search_api_solr Packagist
  • Medium 6.1
    CVE-2025-3902

    Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1.

    Drupal Block Class drupal/block_class Packagist
  • Medium 6.1
    CVE-2025-3901

    Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4.

    Drupal Bootstrap Site Alert drupal/bootstrap_site_alert Packagist
  • Medium 6.1
    CVE-2025-3900

    Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This issue affects Colorbox: from 0.0.0 before 2.1.3.

    Drupal Colorbox drupal/colorbox Packagist
  • Medium 5.3
    CVE-2025-2772

    BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability

    BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authenti…

    BEC Technologies Multiple Routers
  • Medium 5.3
    CVE-2025-2771

    BEC Technologies Multiple Routers Authentication Bypass Vulnerability

    BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The…

    BEC Technologies Multiple Routers
  • Medium 4.9
    CVE-2025-2770

    BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability

    BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required t…

    BEC Technologies Multiple Routers
  • Medium 6.8
    CVE-2025-2763

    CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability

    CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is…

    CarlinKit CPC200-CCPA
  • Medium 6.5
    CVE-2024-47829

    pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

    pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real…

    pnpm pnpm pnpm-stage0 pnpm Wolfi npm
  • Medium 6.8
    CVE-2025-2703 EPSS 16%

    The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify…

    Grafana Grafana Grafana Enterprise grafana Web / CMS Alpine
  • Medium 6.9
    CVE-2025-42604

    Detailed Error Response Vulnerability in Meon KYC solutions

    This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to…

    Meon KYC solutions
  • Medium 5.4
    CVE-2024-10306

    Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

    A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with acc…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9.4 Extended Update Support Linux
  • Medium 6.4
    CVE-2025-1054

    UiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, UI Testimonial Slider, UI Testimonial Grid, and UI Testimonial Carousel widgets in all versions up to…

    UiCore UiCore Elements – Free widgets and templates for Elementor Web / CMS
  • Medium 5.3
    CVE-2025-2595

    Forced Browsing Vulnerability in CODESYS Visualization

    An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.

    CODESYS CODESYS Visualization ICS / OT
  • Medium 6.5
    CVE-2025-0618

    A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a spe…

    Trellix FireEye EDR HX
  • Medium 5.9
    CVE-2025-0926

    Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to…

    Axis Communications AB AXIS Camera Station Pro
  • Medium 6.1
    CVE-2025-1056

    Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the…

    Axis Communications AB AXIS Camera Station Pro
  • Medium 6.5
    CVE-2025-28017

    TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING para…

  • Medium 6.1
    CVE-2025-29526

    A Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allo…

  • Medium 4.3
    CVE-2025-27581 Public exploit

    NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role …

    NIH BRICS
  • Medium 5.8
    CVE-2025-43716

    A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php t…

    ivanti LANDesk Management Suite Network devices