Skip to content
OpenAdvisories

Archive

19 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /19 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.3
    CVE-2022-4980

    General Bytes Crypto Application Server (CAS) Unauthenticated Creation of Admin Account via Default-installation/First-admin Page

    General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used b…

    General Bytes Crypto Application Server (CAS)
  • Critical 9.3
    CVE-2024-13990

    MicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates

    MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle (MitM) att…

    MicroWorld eScan AV
  • Critical 9.3
    CVE-2025-34205

    Vasion Print (formerly PrinterLogic) Dangerous PHP Dead Code Enables RCE

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/r…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34206

    Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such…

    Vasion Print Virtual Appliance Host Print Application (SaaS/VA)
  • Critical 9.3
    CVE-2025-34199

    Vasion Print (formerly PrinterLogic) Insecure SSL Verification Allows Man-in-the-Middle Attacks

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communi…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34198

    Vasion Print (formerly PrinterLogic) Shared / Hardcoded SSH Host Private Keys in Appliance Image

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys (RSA, ECDSA,…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34192

    Vasion Print (formerly PrinterLogic) Usage of Outdated and Unsupported OpenSSL Version

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 201…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34203

    Vasion Print (formerly PrinterLogic) Use of Outdated, End-Of-Life, and Vulnerable Third-Party Components

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 (VA and SaaS deployments) contain multiple Docker containers that include outdated, end-of-life, unsupported, or otherwise vuln…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.8
    CVE-2025-39841

    scsi: lpfc: Fix buffer free/clear order in deferred receive path

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buff…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-5948

    Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business

    The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using …

    Aonetheme Service Finder Bookings Web / CMS
  • Critical 9.8
    CVE-2025-10690

    Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

    The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes…

    bearsthemes Goza - Nonprofit Charity WordPress Theme Web / CMS
  • Critical 9.0
    CVE-2025-48703 Exploited Public exploit Scanner template EPSS 100%

    CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shel…

    CentOS Web Panel CentOS Web Panel
    KEV Nov 4, 2025
  • Critical 9.1
    CVE-2025-57644

    Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticat…