Skip to content
OpenAdvisories

Archive

6 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /6 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2025-46820 Public exploit

    phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact

    phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the c…

    phpgt Dom
  • Critical 9.4
    CVE-2025-46816 Public exploit

    goshs route not protected, allows command execution

    goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c…

    patrickhener goshs github.com/patrickhener/goshs Go
  • Critical 9.1
    CVE-2025-25014 Public exploit EPSS 22%

    Kibana arbitrary code execution via prototype pollution

    A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

    Elastic Kibana
  • High 7.5
    CVE-2025-2011 Public exploit Scanner template EPSS 47%

    Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter

    The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…

    Averta Depicter — Popup & Slider Builder Web / CMS
  • Medium 5.5
    CVE-2025-45250 Public exploit

    MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/…

  • Medium 5.6
    CVE-2025-47256 Public exploit

    Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha for…

    libxmp libxmp libxmp libxmp Debian Ubuntu