Skip to content
OpenAdvisories

Archive

21 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /21 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

93 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-60933

    Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Per…

  • Medium 6.5
    CVE-2025-60790

    ProcessWire CMS vulnerable to resource-exhaustion Denial of Service

    ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

    processwire/processwire Packagist
  • Medium 5.4
    CVE-2025-60506

    Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An…

  • Medium 6.5
    CVE-2025-60427

    LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can…

  • Medium 4.3
    CVE-2025-60511

    Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerabilit…

  • Medium 6.1
    CVE-2025-60934

    Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Perfo…

  • Medium 6.1
    CVE-2025-60280

    Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code…

  • Medium 6.1
    CVE-2025-57521

    Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during applicatio…

  • Medium 5.1
    CVE-2025-56801 Public exploit

    The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB…

  • Medium 6.5
    CVE-2025-56799 Public exploit

    Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanis…

  • Medium 5.1
    CVE-2025-56800 Public exploit

    Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application imp…

  • Medium 5.1
    CVE-2025-56802 Public exploit

    The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration file…

  • Medium 6.5
    CVE-2025-56450

    Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter…