Skip to content
OpenAdvisories

Archive

22 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /22 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

52 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-51458 Public exploit

    SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary …

  • Medium 6.5
    CVE-2025-51472

    Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to exec…

  • Medium 6.6
    CVE-2025-51481

    Dagster Local File Inclusion vulnerability

    Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassin…

    dagster dagster-ge PyPI
  • Medium 6.5
    CVE-2025-51867 Public exploit

    Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing at…

  • Medium 5.4
    CVE-2025-51479

    Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated at…

  • Medium 6.5
    CVE-2025-51859 Public exploit

    Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker c…

  • Medium 6.9
    CVE-2025-51471 Public exploit EPSS 19%

    Ollama vulnerable to Cross-Domain Token Exposure

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

    k8sgpt mods ollama github.com/ollama/ollama Wolfi Go
  • Medium 6.1
    CVE-2025-51862 Public exploit

    Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. A…

  • Medium 6.1
    CVE-2025-51462

    Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attac…

  • Medium 6.1
    CVE-2025-51858 Public exploit

    Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbi…

  • Medium 6.5
    CVE-2025-51459

    File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers …

  • Medium 6.1
    CVE-2025-51863 Public exploit

    Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to exe…