Skip to content
OpenAdvisories

Archive

2 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /2 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-26416

    In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow.…

    Google Android webkit2gtk wpewebkit Android Debian
  • Critical 9.8
    CVE-2025-22435

    In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired …

    Google Android Android
  • Critical 9.8
    CVE-2025-22429

    In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could l…

    Google Android Android
  • Critical 9.8
    CVE-2025-9276

    Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability

    Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-ce…

    Cockroach Labs cockroach-k8s-request-cert
  • Critical 9.4
    CVE-2025-9696

    Use of Hard-coded Credentials in SunPower PVS6

    The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servici…

    SunPower PVS6
  • Critical 9.3
    CVE-2025-52551

    Proprietary protocol allows for unauthenticated file operations

    E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system.

    Copeland LP E2 Facility Management System
  • Critical 9.2
    CVE-2025-52549

    Predictable root linux password generation

    E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.

    Copeland LP E3 Supervisory Control
  • Critical 9.3
    CVE-2025-6519

    Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services

    E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

    Copeland LP E3 Supervisory Control
  • Critical 9.8
    CVE-2025-5662

    Deserialization Vulnerability in h2oai/h2o-3

    A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Va…

    h2oai h2oai/h2o-3
  • Critical 9.8
    CVE-2025-57140

    rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.