Skip to content
OpenAdvisories

Archive

23 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /23 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.3
    CVE-2016-15044 Public exploit

    Kaltura < 11.1.0-2 PHP Object Injection RCE

    A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafte…

    Kaltura Video Platform
  • High 7.8
    CVE-2025-6018 Public exploit

    Pam-config: lpe from unprivileged to allow_active in pam

    A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges n…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux
  • High 8.7
    CVE-2010-10012 Public exploit

    httpdASM 0.92 Path Traversal

    A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system. By sending a specially crafted GET request containing a sequence of URL-encode…

    Japheth httpdasm
  • Critical 9.3
    CVE-2015-10141 Public exploit Scanner template

    Xdebug Remote Debugger Unauthenticated OS Command Execution

    An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands …

    Xdebug Xdebug xdebug xdebug Debian Ubuntu
  • High 8.5
    CVE-2016-15045 Public exploit

    Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation

    A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuratio…

    Wuhan Deepin Technology Deepin Linux Linux
  • Critical 9.3
    CVE-2017-20198 Public exploit

    DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse

    The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privil…

    D2iQ DC/OS Marathon
  • High 8.7
    CVE-2018-25113 Public exploit

    Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal

    An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile e…

    Dicoogle Project PACS Web Server
  • Critical 9.3
    CVE-2018-25114 Public exploit Scanner template

    osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution

    A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installatio…

    Os Commerce Online Merchant
  • Critical 9.3
    CVE-2022-4978 Public exploit

    Steppschuh Remote Control Server 3.1.1.12 Unauthenticated RCE

    Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard inp…

    Steppschuh Remote Control Collection Server
  • High 8.1
    CVE-2025-31700 Public exploit

    A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending sp…

    Dahua IPC SD
  • Medium 4.8
    CVE-2025-50481 Public exploit

    Mezzanine CMS vulnerable to Cross-site Scripting

    A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.

    mezzanine PyPI
  • High 7.1
    CVE-2025-46099 Public exploit

    In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module dire…

  • Medium 5.4
    CVE-2025-46171 Public exploit

    vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authentica…