Skip to content
OpenAdvisories

Archive

26 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /26 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.4
    CVE-2025-59934 Public exploit

    Formbricks missing JWT signature verification

    Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both…

    formbricks formbricks
  • High 8.2
    CVE-2025-59845 Public exploit

    Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

    Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. Th…

    apollographql embeddable-explorer @apollo/sandbox @apollo/explorer npm
  • Medium 6.9
    CVE-2025-59843 Public exploit

    FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

    Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3…

    FlagForgeCTF flagForge
  • High 7.0
    CVE-2025-9267 Public exploit

    In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attem…

    Seagate Toolkit
  • Medium 6.5
    CVE-2025-10307 Public exploit

    Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion

    The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for…

    Softaculous Backuply – Backup, Restore, Migrate and Clone Web / CMS
  • Medium 4.3
    CVE-2025-10377 Public exploit

    System Dashboard <= 2.8.20 - Cross-Site Request Forgery

    The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers …

    qriouslad System Dashboard Web / CMS
  • High 8.4
    CVE-2025-56383 Public exploit

    Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. …