Skip to content
OpenAdvisories

Archive

10 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /10 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

55 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-32989

    Gnutls: vulnerability in gnutls sct extension parsing

    A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-32988

    Gnutls: vulnerability in gnutls othername san export

    A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call as…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 4.8
    CVE-2025-6236

    Hostel < 1.1.5.9 - Admin+ Stored XSS

    The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for examp…

    Web / CMS
  • Medium 6.1
    CVE-2025-6234

    Hostel < 1.1.5.8 - Reflected XSS

    The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

    Web / CMS
  • Medium 5.5
    CVE-2025-7387

    Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make…

    lanacodes Lana Downloads Manager Web / CMS
  • Medium 5.6
    CVE-2025-46406

    A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high …

    Gallagher Command Centre Server
  • Medium 4.3
    CVE-2025-44003

    Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with…

    Gallagher T-Series Readers
  • Medium 6.5
    CVE-2025-35983

    Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged att…

    Gallagher Controller 7000
  • Medium 5.4
    CVE-2025-4406

    wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar

    The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

    Tomdever wpForo Forum Web / CMS
  • Medium 6.1
    CVE-2025-5807

    Gwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter

    The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and including, 4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for una…

    mpol Gwolle Guestbook Web / CMS
  • Medium 6.1
    CVE-2024-36697

    A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attacker…

  • Medium 6.1
    CVE-2025-28245

    Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web…

  • Medium 6.1
    CVE-2025-45662

    A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attac…

  • Medium 4.1
    CVE-2025-47811

    In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or …

    Wftpserver Wing FTP Server
  • Medium 4.3
    CVE-2025-47813 Exploited Scanner template EPSS 63%

    loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a…

    Wftpserver Wing FTP Server
    KEV Mar 16, 2026