Skip to content
OpenAdvisories

Archive

18 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /18 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2025-47410

    Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

    Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on b…

    Apache Software Foundation Apache Geode org.apache.geode:geode-web Maven
  • High 8.8
    CVE-2025-9890

    Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution

    The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated atta…

    mndpsingh287 Theme Editor Web / CMS
  • High 7.8
    CVE-2025-5555

    Nixdorf Wincor PORT IO Driver IOCTL wnport.sys sub_11100 stack-based overflow

    A vulnerability has been found in Nixdorf Wincor PORT IO Driver up to 1.0.0.1. This affects the function sub_11100 in the library wnport.sys of the component IOCTL Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to ap…

    Nixdorf Wincor PORT IO Driver
  • High 7.5
    CVE-2025-11691

    PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection

    The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parame…

    themeisle PPOM – Product Addons & Custom Fields for WooCommerce Web / CMS
  • High 7.5
    CVE-2025-11517

    Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass

    The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free all…

    stellarwp Event Tickets and Registration Web / CMS
  • High 7.2
    CVE-2020-36853

    10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change

    The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it…

    10web 10Web Map Builder for Google Maps Web / CMS