Skip to content
OpenAdvisories

Archive

2 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /2 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-53116

    nvmet: avoid potential UAF in nvmet_req_complete()

    In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2023-53083

    nfsd: don't replace page in rq_pages if it's a continuation of last page

    In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2025-3927

    CVE-2025-3927

    Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices.

    Digigram PYKO-OUT
  • Critical 9.9
    CVE-2025-2605 EPSS 16%

    Authenticated command injection

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywe…

    Honeywell MB-Secure ICS / OT
  • Critical 9.8
    CVE-2025-2421

    Remote Code Execution in Profelis Informatics' SambaBox

    Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: before 5.1.

    Profelis Informatics SambaBox
  • Critical 9.8
    CVE-2025-2812 Public exploit

    SQLi in Mydata Informatics' Ticket Sales Automation

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection. This issue affects Ticket Sales Automation: before 03.04.2025 (DD.MM.YYYY).

    Mydata Informatics Ticket Sales Automation
  • Critical 9.8
    CVE-2025-3709

    Flowring Technology Agentflow - Account Lockout Bypass

    Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.

    Flowring Agentflow
  • Critical 9.8
    CVE-2025-3708

    Le-show Medical Practice Management System - SQL Injection

    Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

    Le-yan Le-show
  • Critical 9.8
    CVE-2025-3746

    OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation

    The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's identity prior to updating their details, like email. This ma…

    thedrifted OTP-less one tap Sign in Web / CMS
  • Critical 9.8
    CVE-2025-45800

    TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of th…

  • Critical 9.8
    CVE-2025-44868

    Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm…

  • Critical 9.8
    CVE-2025-44872

    Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function vi…

  • Critical 9.8
    CVE-2025-44877

    Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function vi…