Skip to content
OpenAdvisories

Archive

21 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /21 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 2.1
    CVE-2025-43753

    Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024…

    Liferay DXP Portal com.liferay:com.liferay.layout.taglib Maven
  • Low 2.5
    CVE-2025-9309

    Tenda AC10 MD5 Hash shadow hard-coded credentials

    A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high deg…

    Tenda AC10
  • Low 3.3
    CVE-2025-9308

    yarnpkg Yarn request-manager.js setOptions redos

    A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack.…

    yarnpkg Yarn node-yarnpkg node-yarnpkg Debian Ubuntu Wolfi
  • Low 3.5
    CVE-2025-9306

    SourceCodester Advanced School Management System addNotice cross site scripting

    A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice/addNotice. The manipulation of the argument noticeSubject results in cross site scripting. It is po…

    SourceCodester Advanced School Management System
  • Low 3.3
    CVE-2025-9301

    cmake cmForEachCommand.cxx ReplayItems assertion

    A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit…

    cmake cmake cmake Debian Ubuntu Azure Linux
  • Low 3.8
    CVE-2025-53971

    Channel and Team Membership APIs inadvertently allow loss of Member privileges.

    Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endp…

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.5
    CVE-2025-47700

    AI plugin APIs can be triggered using post actions

    Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.5
    CVE-2025-49810

    Thread summarization allows persistent access to channel

    Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.5
    CVE-2025-55523 Scanner template

    An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory t…