Skip to content
OpenAdvisories

Archive

11 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /11 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 6.8
    CVE-2025-30024

    The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the mi…

    Axis Communications AB AXIS Device Manager
  • Medium 5.9
    CVE-2025-6200

    GeoDirectory < 2.8.120 - Contributor+ Stored XSS

    The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stor…

    Web / CMS
  • Medium 4.3
    CVE-2025-2942

    Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

    The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

    Web / CMS
  • Medium 5.3
    CVE-2025-5241

    Denial-of-Service Vulnerability in MELSEC iQ-F Series

    Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwor…

    Mitsubishi Electric MELSEC iQ-F Series FX5U-32MR/DS MELSEC iQ-F Series FX5UC-64MT/DSS MELSEC iQ-F Series FX5U-80MT/ESS ICS / OT
  • Medium 5.3
    CVE-2023-38327

    An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.ph…

  • Medium 6.1
    CVE-2023-38329

    An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in cal…

  • Medium 5.8
    CVE-2025-53864

    Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

    Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the G…

    Connect2id Nimbus JOSE+JWT druid tez Ubuntu Wolfi Maven
  • Medium 4.1
    CVE-2025-45582

    GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step pro…

    GNU Tar tar tar Ubuntu Azure Linux
  • Medium 4.9
    CVE-2025-52994

    phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

    gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

    phpThumb project phpThumb james-heinrich/phpthumb Packagist