Skip to content
OpenAdvisories

Archive

20 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /20 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

39 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-9288

    Missing type checks leading to hash rewind and passing on crafted data

    Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

    opensearch-dashboards-3 opensearch-dashboards-3-dashboards-reporting opensearch-dashboards-3-dashboards-observability opensearch-dashboards-3-alerting-dashboards-plugin Debian Ubuntu Azure Linux Wolfi npm
  • Critical 9.1
    CVE-2025-9287

    Missing type checks leading to hash rewind and passing on crafted data

    Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

    opensearch-dashboards-3 opensearch-dashboards-3-dashboards-reporting opensearch-dashboards-3-dashboards-observability opensearch-dashboards-3-alerting-dashboards-plugin Debian Ubuntu Wolfi npm
  • Critical 9.3
    CVE-2025-55746 Public exploit Scanner template

    Directus allows unauthenticated file upload and file modification due to lacking input sanitization

    Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without …

    directus directus directus @directus/api npm
  • Critical 9.8
    CVE-2025-8611

    AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability

    AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploi…

    AOMEI Cyber Backup
  • Critical 9.8
    CVE-2025-8610

    AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability

    AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploi…

    AOMEI Cyber Backup
  • Critical 9.3
    CVE-2011-10026 Public exploit

    Spreecommerce < 0.50.x API RCE

    Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamica…

    Spreecommerce Spreecommerce spree rd_searchlogic RubyGems
  • Critical 9.3
    CVE-2010-20103 Public exploit Scanner template EPSS 15%

    ProFTPD 1.3.3c Backdoor Command Execution

    A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell command…

    ProFTPD Project ProFTPD (Professional FTP Daemon)
  • Critical 9.3
    CVE-2010-20049 Public exploit

    LeapFTP < 3.1.x Stack Buffer Overflow

    LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the…

    LeapWare LeapFTP
  • Critical 9.3
    CVE-2010-20059 Public exploit

    FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

    FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.

    iXsystems FreeNAS
  • Critical 9.3
    CVE-2025-9074 Public exploit

    Docker Desktop allows unauthenticated access to Docker Engine API from containers

    A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolati…

    Docker Docker Desktop
  • Critical 9.8
    CVE-2025-27129

    An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110.…

    Tenda AC6 V5.0
  • Critical 9.6
    CVE-2025-49381

    WordPress ads.txt Guru Connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects ads.txt Guru Connect: from n/a through <= 1.1.1.

    ads.txt Guru ads.txt Guru Connect
  • Critical 9.8
    CVE-2025-49400

    WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.

    osamaesh WP Visitor Statistics (Real Time Traffic)
  • Critical 10.0
    CVE-2025-49408

    WordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7.

    WPDeveloper Templately
  • Critical 9.8
    CVE-2025-49409

    WordPress SensorPress plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs SensorPress allows Stored XSS. This issue affects SensorPress: from n/a through 1.0.

    brewlabs SensorPress
  • Critical 10.0
    CVE-2025-49410

    WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.

    Imran Emu TC Testimonials
  • Critical 9.8
    CVE-2025-49422

    WordPress Support Ticket Plugin <= 1.9 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in themepassion Support Ticket support-ticket allows Privilege Escalation.This issue affects Support Ticket: from n/a through <= 1.9.

    Theme passion Support Ticket
  • Critical 9.8
    CVE-2025-49434

    WordPress Cars4Rent Theme <= 1.4.2 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in axiomthemes Cars4Rent cars4rent allows Object Injection.This issue affects Cars4Rent: from n/a through <= 1.4.2.

    axiomthemes Cars4Rent
  • Critical 9.8
    CVE-2025-49890

    WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Organic Beauty organic-beauty allows Object Injection.This issue affects Organic Beauty: from n/a through <= 1.4.6.

    ThemeREX Organic Beauty
  • Critical 10.0
    CVE-2025-48148 Public exploit EPSS 18%

    WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Malicious Files.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.

    StoreKeeper StoreKeeper for WooCommerce Web / CMS
  • Critical 9.9
    CVE-2025-48169

    WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine code-engine allows Remote Code Inclusion.This issue affects Code Engine: from n/a through <= 0.3.3.

    Jordy Meow Code Engine
  • Critical 9.9
    CVE-2025-53213

    WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-carrier-conditional-shipping allows Using Malicious Files.This issue affects ReachShip WooCommerce Mu…

    ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping Web / CMS
  • Critical 9.8
    CVE-2025-53299

    WordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through <= 1.5.8.

    ThemeMakers ThemeMakers Visual Content Composer
  • Critical 10.0
    CVE-2025-53577

    WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Code Inclusion.This issue affects Global DNS: from n/a through <= 3.1.0.

    thehp Global DNS
  • Critical 9.8
    CVE-2025-53580 Public exploit

    WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.

    Quantum Cloud Simple Business Directory Pro
  • Critical 9.8
    CVE-2025-54014

    WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 15.1.

    QuanticaLabs MediCenter - Health Medical Clinic
  • Critical 9.3
    CVE-2025-54048

    WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.

    miniOrange Custom API for WP
  • Critical 9.9
    CVE-2025-54049

    WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.

    miniOrange Custom API for WP
  • Critical 9.1
    CVE-2025-54677 Public exploit

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking & Scheduling Calendar for WordPress by…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Critical 9.8
    CVE-2025-54713

    WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.…

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • Critical 9.3
    CVE-2025-54726 Public exploit Scanner template

    WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6.

    Miguel Useche JS Archive List
  • Critical 9.3
    CVE-2024-12223

    Stored Cross-site Scripting (XSS) in Nutanix Prism Central

    Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.

    Nutanix Prism Central
  • Critical 9.8
    CVE-2024-50640

    jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function

  • Critical 9.8
    CVE-2024-57157

    Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a …

  • Critical 9.8
    CVE-2024-57155

    Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a …

  • Critical 9.8
    CVE-2024-57154

    Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted pa…

  • Critical 9.8
    CVE-2025-55444

    A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Art…

  • Critical 9.8
    CVE-2025-50904

    There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker ca…

  • Critical 9.8
    CVE-2025-50901

    JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, wh…