Skip to content
OpenAdvisories

Archive

1 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /1 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 4.0
    CVE-2025-10735

    Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery

    The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers …

    bPlugins Block for Mailchimp – Add Email Subscription Forms and Collect Leads Web / CMS
  • Medium 5.9
    CVE-2025-10744

    File Manager, Code editor, backup by Managefy <= 1.6.1 - Unauthenticated Information Exposure

    The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to …

    softdiscover File Manager, Code Editor, and Backup by Managefy Web / CMS
  • Medium 6.5
    CVE-2024-57494

    Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escala…

  • Medium 5.3
    CVE-2025-59685

    Kazaar 1.25.12 allows a JWT with none in the alg field.

  • Medium 4.3
    CVE-2025-59687

    IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details…

  • Medium 6.5
    CVE-2025-59686

    Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.

  • Medium 6.3
    CVE-2025-61189

    Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFi…

  • Medium 6.3
    CVE-2025-61188

    Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attacker…

  • Medium 6.5
    CVE-2025-61044

    TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName para…

  • Medium 5.5
    CVE-2025-57275

    SPDK is vulnerable to buffer overflow in the NVMe-oF target component

    Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

    spdk PyPI
  • Medium 5.4
    CVE-2025-57389 Public exploit

    A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 al…

  • Medium 6.1
    CVE-2025-57444

    An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Ma…

  • Medium 4.6
    CVE-2025-56514 Public exploit

    Fiora chat user avatar is vulnerable to XSS via SVG files

    Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users.

    fiora npm