Skip to content
OpenAdvisories

Archive

21 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /21 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2025-47947 Public exploit

    ModSecurity Has Possible DoS Vulnerability

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content…

    owasp-modsecurity ModSecurity modsecurity-apache mod_security Debian Ubuntu Azure Linux
  • High 7.7
    CVE-2025-48060 Public exploit

    AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)

    jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of …

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • High 7.7
    CVE-2025-46822 Public exploit Scanner template

    Unauthenticated Arbitrary File Read via Absolute Path

    OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This…

    OsamaTaher Java-springboot-codebase
  • High 7.5
    CVE-2025-40775 Public exploit EPSS 15%

    DNS message with invalid TSIG causes an assertion failure

    When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 th…

    ISC BIND 9 bind9 bind Debian Azure Linux Alpine
  • Medium 6.4
    CVE-2025-4611 Public exploit

    Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode

    The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and outpu…

    rilwis Slim SEO – A Fast & Automated SEO Plugin For WordPress Web / CMS
  • Critical 9.8
    CVE-2025-4524 Public exploit Scanner template EPSS 11%

    Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion

    The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to incl…

    WPStylish Madara – Responsive and modern WordPress theme for manga sites Web / CMS
  • Critical 9.8
    CVE-2025-4094 Public exploit EPSS 17%

    Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

    The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

    Web / CMS
  • High 7.7
    CVE-2024-56429 Public exploit

    itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users …

    Itech iLabClient
  • Medium 5.5
    CVE-2024-56428 Public exploit

    The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the …

  • Critical 9.1
    CVE-2025-27558 Public exploit

    IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected A…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu