Skip to content
OpenAdvisories

Archive

10 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /10 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-11579 Public exploit

    DoS via Out Of Memory Crash

    github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.

    nwaples rardecode kubescape kots Debian Ubuntu Wolfi Go
  • Medium 4.8
    CVE-2025-41089 Public exploit

    Reflected Cross-Site Scripting (XSS) in CMS

    Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Config…

    Xibo Signage xibo-cms
  • Medium 5.1
    CVE-2025-41088 Public exploit

    Stored Cross-Site Scripting (XSS) in CMS

    Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Element…

    Xibo Signage xibo-cms
  • Medium 6.6
    CVE-2025-21065 Public exploit

    Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands …

    Samsung Mobile Retail Mode
  • Medium 5.3
    CVE-2025-11449 Public exploit

    Reflected Cross Site Scripting in ServiceNow AI Platform

    ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafte…

    ServiceNow ServiceNow AI Platform
  • High 8.3
    CVE-2025-55903 Public exploit

    A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill T…

  • Medium 6.1
    CVE-2025-61319 Public exploit

    ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. Wh…

  • Medium 6.5
    CVE-2025-61505 Public exploit

    e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-c…

  • High 8.1
    CVE-2025-60378 Public exploit

    Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into i…

  • High 8.3
    CVE-2025-60880 Public exploit

    Bagisto is vulnerable to XSS through Admin Panel's product creation path

    An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin us…

    bagisto/bagisto Packagist