Skip to content
OpenAdvisories

Archive

18 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /18 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-10035 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Deserialization Vulnerability in GoAnywhere MFT's License Servlet

    A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

    Fortra GoAnywhere MFT
    KEV Sep 29, 2025
  • High 7.3
    CVE-2025-59424 Public exploit

    LinkAce Vulnerable to Stored XSS on the Audit Page

    LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in …

    Kovah LinkAce
  • High 8.8
    CVE-2025-10666 Public exploit

    D-Link DIR-825 apply.cgi sub_4106d4 buffer overflow

    A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely.…

    D-Link DIR-825 Network devices
  • High 8.7
    CVE-2025-40677 Public exploit

    SQL injection vulnerability in Summar Software´s Portal del Empleado

    SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/Member…

    Summar Software Portal del Empleado
  • Medium 5.3
    CVE-2025-10493 Public exploit

    Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

    The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated…

    prasunsen Chained Quiz Web / CMS
  • High 8.8
    CVE-2023-49367 Public exploit

    An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information v…

  • Medium 6.5
    CVE-2025-55911 Public exploit

    An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php a…

  • High 7.3
    CVE-2025-55912 Public exploit

    An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in…