Skip to content
OpenAdvisories

Archive

2 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /2 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.4
    CVE-2025-34074 Public exploit

    Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write

    An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote…

    Lucee Association Switzerland Lucee
  • Critical 10.0
    CVE-2025-20309

    Cisco Unified Communications Manager Static SSH Credentials Vulnerability

    A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, w…

    Cisco Cisco Unified Communications Manager Network devices
  • Critical 10.0
    CVE-2025-34073 Public exploit Scanner template

    stamparm/maltrail <=0.54 Remote Command Execution

    An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due t…

    stamparm maltrail
  • Critical 9.3
    CVE-2025-34072

    Anthropic Slack MCP Server Data Exfiltration via Link Unfurling

    A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages contain…

    Anthropic Slack MCP Server
  • Critical 9.4
    CVE-2025-34071 Public exploit

    GFI Kerio Control Unsigned System Image Upload Root Code Execution

    A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modi…

    GFI Software Kerio Control
  • Critical 10.0
    CVE-2025-34070

    GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces

    A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services …

    GFI Software Kerio Control
  • Critical 9.5
    CVE-2025-34069 Public exploit

    GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding

    An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to…

    GFI Software Kerio Control
  • Critical 10.0
    CVE-2025-34067 EPSS 22%

    Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson

    An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserial…

    Hikvision Integrated Security Management Platform
  • Critical 9.8
    CVE-2024-13786

    Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection

    The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attacke…

    ThemeREX Education Center | LMS & Online Courses WordPress Theme Web / CMS
  • Critical 9.8
    CVE-2025-5746

    Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload

    The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dnd_upload_cf7_upload_chunks() function in version 5.0 - 5.0.5 (when bundled with the PrintSpace…

    CodeDropz Drag and Drop Multiple File Upload (Pro) - WooCommerce Web / CMS
  • Critical 9.8
    CVE-2025-4689

    Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution

    The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnera…

    scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Web / CMS
  • Critical 9.8
    CVE-2025-45814

    Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 …

  • Critical 9.8
    CVE-2025-45813

    ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.