Skip to content
OpenAdvisories

Archive

26 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /26 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-59843 Public exploit

    FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

    Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3…

    FlagForgeCTF flagForge
  • Medium 6.5
    CVE-2025-10307 Public exploit

    Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion

    The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for…

    Softaculous Backuply – Backup, Restore, Migrate and Clone Web / CMS
  • Medium 4.3
    CVE-2025-10377 Public exploit

    System Dashboard <= 2.8.20 - Cross-Site Request Forgery

    The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers …

    qriouslad System Dashboard Web / CMS