Skip to content
OpenAdvisories

Archive

21 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /21 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.2
    CVE-2025-34026 Exploited Scanner template EPSS 82%

    Versa Concerto Actuator Authentication Bypass Information Leak

    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap …

    Versa Concerto
    KEV Jan 22, 2026
  • Critical 10.0
    CVE-2025-34027 Scanner template EPSS 46%

    Versa Concerto Authentication Bypass File Write Remote Code Execution

    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to T…

    Versa Concerto
  • Critical 10.0
    CVE-2025-36535

    AutomationDirect MB-Gateway Missing Authentication for Critical Function

    The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality.

    Automation Direct MB-Gateway
  • Critical 9.8
    CVE-2025-41426

    Vertiv Liebert RDU101 and UNITY Stack-based Buffer Overflow

    Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device.

    Vertiv Liebert IS-UNITY Liebert RDU101
  • Critical 9.8
    CVE-2025-46412

    Vertiv Liebert RDU101 and UNITY Authentication Bypass Using an Alternate Path or Channel

    Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication.

    Vertiv Liebert RDU101 Liebert IS-UNITY
  • Critical 9.1
    CVE-2025-41232

    CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods

    Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) an…

    Spring Spring Security org.springframework.security:spring-security-core org.springframework.security:spring-security-aspects Maven
  • Critical 9.8
    CVE-2025-4524 Public exploit Scanner template EPSS 11%

    Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion

    The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to incl…

    WPStylish Madara – Responsive and modern WordPress theme for manga sites Web / CMS
  • Critical 9.8
    CVE-2025-4094 Public exploit EPSS 17%

    Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

    The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

    Web / CMS
  • Critical 9.1
    CVE-2025-27558 Public exploit

    IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected A…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Critical 10.0
    CVE-2025-48200

    The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution

    The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.

    TYPO3 sr feuser register extension sjbr/sr-feuser-register Packagist
  • Critical 9.8
    CVE-2025-44083

    An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication