Skip to content
OpenAdvisories

Archive

7 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /7 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.7
    CVE-2025-54787

    SuiteCRM: Improper Authorization for attachment downloads

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named …

    Suite CRM SuiteCRM
  • Low 3.3
    CVE-2025-8698

    Open5GS AMF Service nsmf-handler.c amf_nsmf_pdusession_handle_release_sm_context assertion

    A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context of the file src/amf/nsmf-handler.c of the component AMF Service. The manipulation leads to reachabl…

  • Low 3.7
    CVE-2024-56339

    IBM WebSphere Application Server information disclosure

    IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Low 2.5
    CVE-2025-54798

    tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter

    tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

    raszi node-tmp katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • Low 2.3
    CVE-2025-54799

    Lego does not enforce HTTPS

    Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the ht…

    go-acme lego sftpgo terraform-provider-acme Debian Ubuntu Wolfi Go
  • Low 3.8
    CVE-2025-48709

    BMC Control-M/Server cleartext database credentials in process lists and logs

    BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on…

    BMC Control-M/Server