Skip to content
OpenAdvisories

Archive

18 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /18 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-7693

    Rockwell Automation Micro800 Vulnerability

    A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED …

    Rockwell Automation PLC - Micro850 L50E ICS / OT
  • Critical 9.4
    CVE-2025-55299

    VaulTLS has a password-based login exploit in additional user accounts

    VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that…

    7ritn VaulTLS
  • Critical 9.4
    CVE-2025-55293

    Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB

    Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a new key. First sending a empty key bypasses 'if (p.public_key.size > 0) {', clearing the existing publ…

    meshtastic firmware
  • Critical 9.1
    CVE-2025-55283

    aiven-db-migrate allows Privilege Escalation through use of psql during migration

    aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases during a migration from an untrusted source server. The vulnerability stems from…

    aiven aiven-db-migrate
  • Critical 9.1
    CVE-2025-55282

    aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration

    aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack…

    aiven aiven-db-migrate
  • Critical 9.1
    CVE-2025-55205

    Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

    Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-s…

    projectcapsule capsule github.com/projectcapsule/capsule Go
  • Critical 9.1
    CVE-2025-54117

    NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor

    NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor…

    NamelessMC Nameless
  • Critical 9.8
    CVE-2025-31715

    In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote es…

    Unisoc (Shanghai) Technologies SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
  • Critical 9.8
    CVE-2025-55591

    TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac para…