Skip to content
OpenAdvisories

Archive

21 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /21 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 3.5
    CVE-2025-48070

    Plane has insecure permissions in UserSerializer

    Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another …

    makeplane plane
  • Low 3.3
    CVE-2025-48064

    GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosure

    GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of …

    desktop desktop
  • Low 3.1
    CVE-2025-5031

    Ackites KillWxapkg wxapkg File Decompression resource consumption

    A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the component wxapkg File Decompression Handler. The manipulation leads to resource consumption. The attack may be ini…

    Ackites KillWxapkg github.com/Ackites/KillWxapkg Go
  • Low 3.1
    CVE-2025-48009

    Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

    Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • Low 2.4
    CVE-2025-1421

    Formula injection in a CSV file in Proget MDM

    Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could…

    Proget Proget
  • Low 2.4
    CVE-2025-1420

    XSS in Proget MDM

    Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack. This issue has been fixed in 2.17.5 version of Konsola Proget (server part …

    Proget Proget
  • Low 2.4
    CVE-2025-1419

    XSS in Proget MDM

    Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

    Proget Proget
  • Low 2.4
    CVE-2025-5011

    moonlightL hexo-boot Dynamic List Page index.html cross site scripting

    A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be…

    moonlightL hexo-boot