Skip to content
OpenAdvisories

Archive

3 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /3 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-55748 Scanner template

    XWiki Platform's configuration files can be accessed through jsx and sx endpoints

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configurati…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-skin-skinx Maven
  • Critical 9.3
    CVE-2025-55747 Scanner template

    XWiki Platform's configuration files can be accessed through the webjars API

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-webjars-api org.xwiki.platform:xwiki-platform-webjars Maven
  • Critical 9.0
    CVE-2025-53690 Exploited Public exploit EPSS 61%

    Sitecore Products ViewState Deserialization Vulnerability

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

    Sitecore Experience Platform (XP) Experience Manager (XM)
    KEV Sep 4, 2025
  • Critical 9.8
    CVE-2025-53693 Public exploit EPSS 20%

    HTML Cache Poisoning through Unsafe Reflections

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9…

    Sitecore Experience Platform (XP) Sitecore Experience Manager (XM)
  • Critical 9.8
    CVE-2024-43166

    Apache DolphinScheduler Incorrect Default Permissions Vulnerability

    Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler Maven
  • Critical 9.8
    CVE-2025-1740

    Authentication Bypass in Akinsoft's MyRezzta

    Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.

    Akinsoft MyRezzta
  • Critical 9.8
    CVE-2024-32444 Public exploit

    WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6.

    InspiryThemes RealHomes
  • Critical 9.1
    CVE-2025-57148

    phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the l…

  • Critical 9.8
    CVE-2025-57052 Public exploit

    cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.…

    cjson cjson cjson Debian Ubuntu Alpine
  • Critical 9.4
    CVE-2025-56752

    A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass aut…