Skip to content
OpenAdvisories

Archive

22 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /22 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 8.0
    CVE-2025-7766 Public exploit

    Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference

    Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.

    LANTRONIX Provisioning Manager
  • Medium 6.3
    CVE-2025-8018 Public exploit

    code-projects Food Ordering Review System reservation_page.php sql injection

    A vulnerability was found in code-projects Food Ordering Review System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user/reservation_page.php. The manipulation of the argument reg_Id leads to s…

    code-projects Food Ordering Review System
  • High 8.8
    CVE-2015-10140 Public exploit

    Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion

    The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.

  • Medium 5.3
    CVE-2025-6082 Public exploit

    Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure

    The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing t…

    mia4 Birth Chart Compatibility Web / CMS
  • High 7.8
    CVE-2025-38352 Exploited Public exploit

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
    KEV Sep 4, 2025
  • Critical 9.8
    CVE-2012-10020 Public exploit

    FoxyPress <= 0.4.2.1 - Arbitrary File Upload

    The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files …

    WebMovementLLC FoxyPress Web / CMS
  • Critical 9.8
    CVE-2015-10137 Public exploit

    Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload

    The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated atta…

    N-Media Website Contact Form With File Upload Web / CMS
  • Medium 6.1
    CVE-2025-51860 Public exploit

    Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container com…

  • Medium 6.5
    CVE-2025-51864 Public exploit

    A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, al…

  • Medium 6.5
    CVE-2025-51458 Public exploit

    SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary …

  • Medium 6.5
    CVE-2025-51867 Public exploit

    Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing at…

  • Medium 6.5
    CVE-2025-51859 Public exploit

    Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker c…

  • High 8.8
    CVE-2025-51865 Public exploit

    Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object…

  • High 8.8
    CVE-2025-51482 Public exploit Scanner template

    Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows re…

  • Medium 6.9
    CVE-2025-51471 Public exploit EPSS 19%

    Ollama vulnerable to Cross-Domain Token Exposure

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

    k8sgpt mods ollama github.com/ollama/ollama Wolfi Go
  • Medium 6.1
    CVE-2025-51862 Public exploit

    Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. A…

  • Medium 6.1
    CVE-2025-51858 Public exploit

    Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbi…

  • Medium 6.1
    CVE-2025-51863 Public exploit

    Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to exe…