Skip to content
OpenAdvisories

Archive

10 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /10 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2025-1727 Public exploit

    End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication

    The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control comma…

    End-of-Train and Head-of-Train remote linking protocol End-of-Train and Head-of-Train remote linking protocol
  • High 8.8
    CVE-2025-53632 Public exploit

    Chall-Manager's scenario decoding process does not check for zip slips

    Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentica…

    ctfer-io chall-manager github.com/ctfer-io/chall-manager Go
  • High 7.5
    CVE-2025-34093 Public exploit

    Polycom HDX Series Telnet Command Injection via lan traceroute

    An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system comma…

    Polycom HDX Series
  • High 8.6
    CVE-2025-34097 Public exploit

    ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE

    An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Up…

    ProcessMaker processmaker
  • High 7.1
    CVE-2025-34098 Public exploit

    Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter Injection

    A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this f…

    Riverbed Technology SteelHead VCX
  • High 7.5
    CVE-2025-53020 Public exploit

    Apache HTTP Server: HTTP/2 DoS by Memory Increase

    Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2025-49812 Public exploit

    Apache HTTP Server: mod_ssl TLS upgrade attack

    In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine