Skip to content
OpenAdvisories

Archive

22 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /22 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-59528 Public exploit Scanner template EPSS 92%

    Flowise has Remote Code Execution vulnerability

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server…

    FlowiseAI Flowise flowise npm
  • Critical 9.6
    CVE-2025-59434

    Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from…

    FlowiseAI Flowise
  • Critical 9.6
    CVE-2025-58255

    WordPress Custom Post Type Images Plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through <= 0.5.

    yonisink Custom Post Type Images
  • Critical 9.8
    CVE-2025-35042

    Airship AI Acropolis default credentials

    Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gaining the privileges of …

    Airship AI Acropolis
  • Critical 9.8
    CVE-2025-57437

    The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet servic…

  • Critical 9.8
    CVE-2025-57601

    AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access…

  • Critical 9.8
    CVE-2025-57441

    The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated T…

  • Critical 9.8
    CVE-2025-57602

    Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a share…

  • Critical 9.8
    CVE-2025-57432

    Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This …

  • Critical 9.8
    CVE-2025-56074

    A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticke…