Skip to content
OpenAdvisories

Archive

26 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /26 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

130 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-10988

    YunaiV ruoyi-vue-pro transfer improper authorization

    A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit is publicly ava…

    YunaiV ruoyi-vue-pro
  • Medium 6.3
    CVE-2025-10987

    YunaiV yudao-cloud HTTP Request transfer improper authorization

    A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper autho…

    YunaiV yudao-cloud
  • Medium 4.3
    CVE-2025-10981

    JeecgBoot exportXls improper authorization

    A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be us…

  • Medium 4.0
    CVE-2025-59362

    Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.

    squid squid3 squid squid Debian Ubuntu Azure Linux Alpine
  • Medium 5.0
    CVE-2025-60251

    Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring.

    Unitree G1 Go2 H1
  • Medium 4.7
    CVE-2025-60250

    Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f255…

    Unitree Go2 G1 H1
  • Medium 6.1
    CVE-2025-57292

    Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The applic…

  • Medium 6.8
    CVE-2025-57692

    PiranhaCMS stored XSS

    PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.

    Piranha NuGet
  • Medium 6.1
    CVE-2025-26258

    Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'

  • Medium 6.8
    CVE-2025-56463

    Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.