Skip to content
OpenAdvisories

Archive

21 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /21 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-62481

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…

    Oracle Oracle Marketing
  • Critical 9.8
    CVE-2025-61757 Exploited Public exploit Scanner template EPSS 89%

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers…

    Oracle Identity Manager
    KEV Nov 21, 2025
  • Critical 9.8
    CVE-2025-53072 Public exploit

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…

    Oracle Oracle Marketing
  • Critical 9.8
    CVE-2025-53037

    Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servi…

    Oracle Oracle Financial Services Analytical Applications Infrastructure
  • Critical —
    GHSA-8pfh-j44r-f654

    Cosmos EVM Vulnerability

    ## Patches Patched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade. ## Workarounds No workarounds for chains that make use of static or dynamic preco…

    github.com/cosmos/evm Go
  • Critical 9.3
    CVE-2025-11534

    Authentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series

    The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.

    Raisecomm RAX701-GC-WP-01 P200R002C53 RAX701-GC-WP-01 P200R002C52
  • Critical 9.4
    CVE-2025-11625

    Host verification bypass and credential leak

    Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.

    wolfSSL wolfSSH
  • Critical 9.8
    CVE-2025-10640

    Missing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional

    An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer se…

    EfficientLab WorkExaminer Professional
  • Critical 10.0
    CVE-2025-12004

    The compare API module breaks Extension:Lockdown

    Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

    The Wikimedia Foundation Mediawiki - Lockdown Extension mediawiki Web / CMS Ubuntu
  • Critical 9.1
    CVE-2025-10916

    FormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion

    The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.

    Web / CMS
  • Critical 9.3
    CVE-2025-7850

    Authenticated OS command execution

    A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

    TP-Link Systems Omada Gateways Festa gateways Omada Pro gateways Network devices
  • Critical 9.3
    CVE-2025-6542

    OS command injection in multiple parameters

    An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

    TP-Link Systems Omada Gateways Omada Pro gateways Festa gateways Network devices
  • Critical 9.8
    CVE-2025-60772

    Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthe…