Skip to content
OpenAdvisories

Archive

12 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /12 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.6
    CVE-2025-49457

    Zoom Clients for Windows - Untrusted Search Path

    Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access

    Zoom Communications Zoom Clients for Windows Windows
  • Critical 10.0
    CVE-2025-55169 Scanner template

    WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'

    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vul…

    LabRedesCefetRJ WeGIA
  • Critical 9.8
    CVE-2025-25256 Public exploit Scanner template EPSS 67%

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vu…

    Fortinet FortiSIEM Network devices
  • Critical 9.4
    CVE-2025-55168

    WeGIA SQL Injection via id_fichamedica at endpoint `GET /html/saude/aplicar_medicamento.php`

    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicar_medicamento.php endpoint, specifically in the id_fichamedi…

    LabRedesCefetRJ WeGIA
  • Critical 9.8
    CVE-2025-53766 EPSS 12%

    GDI+ Remote Code Execution Vulnerability

    Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows Android
  • Critical 9.1
    CVE-2025-50171

    Remote Desktop Spoofing Vulnerability

    Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Windows Server 2022 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows
  • Critical 9.8
    CVE-2025-50165 Public exploit EPSS 15%

    Windows Graphics Component Remote Code Execution Vulnerability

    Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  • Critical 9.4
    CVE-2025-55167

    WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`

    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_depe…

    LabRedesCefetRJ WeGIA
  • Critical 9.1
    CVE-2025-55010

    Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

    Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifyi…

    kanboard kanboard
  • Critical 9.1
    CVE-2025-40746

    A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not pr…

    Siemens SIMATIC RTLS Locating Manager ICS / OT
  • Critical 9.8
    CVE-2025-8059

    B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function

    The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated …

    bPlugins bBlocks – Essential Gutenberg Blocks & Patterns Collection Web / CMS
  • Critical 9.9
    CVE-2025-42957 Public exploit

    Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

    SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effecti…

    SAP SAP S/4HANA (Private Cloud or On-Premise)
  • Critical 9.9
    CVE-2025-42950

    Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

    SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. Thi…

    SAP SAP Landscape Transformation (Analysis Platform)