Skip to content
OpenAdvisories

Archive

14 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /14 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-20265 Public exploit EPSS 16%

    Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability

    A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.  This vulnerability is du…

    Cisco Cisco Firepower Management Center Network devices
  • Critical 9.4
    CVE-2025-8875 Exploited Public exploit

    Insecure Deserialization Vulnerability

    Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

    N-able N-central
    KEV Aug 13, 2025
  • Critical 9.4
    CVE-2025-8876 Exploited

    Command Injection Vulnerability

    Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

    N-able N-central
    KEV Aug 13, 2025
  • Critical 9.3
    CVE-2025-7353

    Rockwell Automation ControlLogix® Ethernet Remote Code Execution Vulnerability

    A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and …

    Rockwell Automation 1756-EN2T/D 1756-EN2TR/C 1756-EN2TP/A ICS / OT
  • Critical 9.3
    CVE-2025-54707

    WordPress MDTF Plugin <= 1.3.3.7 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows SQL Injection.This issue affects MDTF: from n/a through <= 1.3.3.7.

    RealMag777 MDTF
  • Critical 9.0
    CVE-2025-54693

    WordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through <= 1.5.5.

    Epiphyt Form Block
  • Critical 9.8
    CVE-2025-54686

    WordPress Exertio Theme <= 1.3.2 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio exertio allows Object Injection.This issue affects Exertio: from n/a through <= 1.3.2.

    scriptsbundle Exertio
  • Critical 9.3
    CVE-2025-54678

    WordPress Easy Form Builder Plugin <= 3.8.15 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 3.8.15.

    hassantafreshi Easy Form Builder
  • Critical 9.3
    CVE-2025-54669

    WordPress MapSVG Plugin < 8.7.4 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RomanCode MapSVG mapsvg allows SQL Injection.This issue affects MapSVG: from n/a through < 8.7.4.

    RomanCode MapSVG
  • Critical 9.9
    CVE-2025-24775

    WordPress Forms <= 2.9.0 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.9.0.

    Made I.T. Forms
  • Critical 10.0
    CVE-2025-25174

    WordPress BeeTeam368 Extensions Plugin <= 1.9.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a …

    beeteam368 BeeTeam368 Extensions
  • Critical 9.8
    CVE-2025-48293

    WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects Geo Mashup: from n/a through <= 1.13.16.

    Dylan Kuhn Geo Mashup
  • Critical 9.3
    CVE-2025-49059

    WordPress CleverReach® WP Plugin <= 1.5.20 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.20.

    CleverReach® CleverReach® WP
  • Critical 9.9
    CVE-2025-49887

    WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a …

    WPFactory Product XML Feed Manager for WooCommerce Web / CMS
  • Critical 9.3
    CVE-2025-52720

    WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.5.

    highwarden Super Store Finder
  • Critical 9.8
    CVE-2025-8943 Public exploit Scanner template EPSS 75%

    Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

    The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermo…

    flowise npm
  • Critical 9.8
    CVE-2025-8047

    Multiple Plugins from itayamar - Supply Chain Compromise

    The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control …

  • Critical 9.8
    CVE-2025-55346 EPSS 25%

    Unintended dynamic code execution leads to remote code execution by network attackers

    User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

    flowise npm
  • Critical 9.8
    CVE-2025-50518

    A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. Thi…

    libcoap2 libcoap libcoap3 Ubuntu
  • Critical 9.8
    CVE-2025-27845

    In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in …

  • Critical 9.1
    CVE-2025-43983

    KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform…

  • Critical 9.8
    CVE-2025-43984 EPSS 25%

    An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0…