Skip to content
OpenAdvisories

Archive

24 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /24 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.6
    CVE-2025-10894 Public exploit

    Nx: nx/devkit: malicious versions of nx and plugins published to npm

    Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credent…

    Red Hat Red Hat Ansible Automation Platform 2 Red Hat Advanced Cluster Management for Kubernetes 2 OpenShift Serverless
  • Critical 9.3
    CVE-2025-52906 EPSS 15%

    TOTOLINK X6000R Command Injection Vulnerability

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

    Toto Link X6000R
  • Critical 9.1
    CVE-2025-10890

    Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
  • Critical 9.8
    CVE-2025-27034

    Improper Validation of Array Index in Multi-Mode Call Processor

    Memory corruption while selecting the PLMN from SOR failed list.

    Qualcomm Snapdragon
  • Critical 9.8
    CVE-2025-21483

    Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity

    Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

    Qualcomm Snapdragon
  • Critical 9.8
    CVE-2025-9054

    MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'

    The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in …

    Techspawn MultiLoca - WooCommerce Multi Locations Inventory Management Web / CMS
  • Critical 9.8
    CVE-2025-41715

    Missing Authentication for Database Access in Web Application

    The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.

    WAGO Solution Builder Device Sphere ICS / OT
  • Critical 9.8
    CVE-2025-57347

    A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addCon…

  • Critical 9.8
    CVE-2025-57321

    magix-combine-ex vulnerable to prototype pollution

    A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum cons…

    magix-combine-ex npm
  • Critical 9.8
    CVE-2025-56819 Public exploit Scanner template

    An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.