Skip to content
OpenAdvisories

Archive

28 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /28 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-58059

    Valtimo scripting engine can be used to gain access to sensitive data or resources

    Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. …

    valtimo-platform valtimo-backend-libraries com.ritense.valtimo:core Maven
  • Critical 10.0
    CVE-2025-58048

    Paymenter Vulnerable to Remote Code Execution via Public File Uploads

    Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from …

    Paymenter Paymenter paymenter/paymenter Packagist
  • Critical 10.0
    CVE-2025-57819 Exploited Public exploit Scanner template EPSS 95%

    FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

    FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulatio…

    FreePBX endpoint
    KEV Aug 29, 2025
  • Critical 9.8
    CVE-2025-54738

    WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.

    NooTheme Jobmonster
  • Critical 9.8
    CVE-2025-54725

    WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0.

    uxper Golo
  • Critical 9.3
    CVE-2025-54720

    WordPress Nest Addons Plugin <= 1.6.3 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection.This issue affects Nest Addons: from n/a through <= 1.6.3.

    SteelThemes Nest Addons
  • Critical 9.8
    CVE-2025-52761

    WordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager: from n/a through <= 1.4.0.

    manfcarlo WP Funnel Manager
  • Critical 10.0
    CVE-2025-49387 Scanner template

    WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop File Upload for…

    add-ons.org Drag and Drop File Upload for Elementor Forms
  • Critical 9.8
    CVE-2025-49388 Public exploit

    WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Core Plugin: from n/a through <= 2.0.7.

    kamleshyadav Miraculous Core Plugin
  • Critical 9.1
    CVE-2025-48100

    WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.

    extremeidea bidorbuy Store Integrator
  • Critical 9.3
    CVE-2025-39496

    WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6.

    WBW WooBeWoo Product Filter Pro
  • Critical 9.8
    CVE-2024-58240

    tls: separate no-async decryption request handling from async

    In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-54762

    SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload ar…

    DOS SS1
  • Critical 9.8
    CVE-2025-53970

    SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload ar…

    DOS SS1 SS1 Cloud
  • Critical 9.8
    CVE-2025-7955 Public exploit

    RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

    The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to lo…

    pbmacintyre RingCentral Communications Plugin – FREE Web / CMS
  • Critical 9.8
    CVE-2025-55583

    D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability i…