Skip to content
OpenAdvisories

Archive

17 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /17 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Low 2.1
    CVE-2025-62655

    SQL injection in Cargo via Special:CargoExport

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Low 2.0
    CVE-2025-62654

    Stored XSS through system messages in QuizGame

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extension allows Stored XSS.This issue affects MediaWiki QuizGame extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation MediaWiki QuizGame extension Web / CMS
  • Low 2.0
    CVE-2025-62653

    Stored XSS through system messages in PollNY

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extension allows Stored XSS.This issue affects MediaWiki PollNY extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation MediaWiki PollNY extension Web / CMS
  • Low 3.0
    CVE-2025-62505

    SSRF in lobehub/lobe-chat with native web fetch module

    LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls c…

    lobehub lobe-chat @lobehub/chat npm
  • Low 2.0
    CVE-2025-58747

    Dify MCP OAuth Flow Vulnerable to XSS

    Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow imple…

    langgenius dify
  • Low 2.4
    CVE-2025-55100

    Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

    In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.

    Eclipse Foundation USBX
  • Low 2.4
    CVE-2025-55099

    Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()

    In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.

    Eclipse Foundation USBX
  • Low 1.0
    CVE-2025-55098

    Potential out-of-bounds read in _ux_host_class_audio_device_type_get()

    In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_device_type_get() when parsing a descriptor of an USB audio device.

    Eclipse Foundation USBX
  • Low 2.4
    CVE-2025-55097

    Potential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()

    In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.

    Eclipse Foundation USBX
  • Low 2.1
    CVE-2025-55096

    Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()

    In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_hid_report_descriptor_get()  when parsing a descriptor of an USB HID device.

    Eclipse Foundation NetX Duo
  • Low 3.4
    CVE-2025-62643

    The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in…

    Restaurant Brands International assistant platform
  • Low 3.3
    CVE-2025-60361

    radare2 v5.9.8 and before contains a memory leak in the function bochs_open.

    radare2 Ubuntu