Skip to content
OpenAdvisories

Archive

22 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /22 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 2.0
    CVE-2025-62247

    Liferay Portal and DXP are Missing Authorization in Collection Provider

    Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.…

    Liferay DXP Portal com.liferay:com.liferay.search.experiences.service Maven
  • Low —
    GHSA-xcpm-76hf-c9cc

    Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice

    The safe function `any_as_u8_slice` can create byte slices that reference uninitialized memory when used with types containing padding bytes. The function uses `slice::from_raw_parts` to create a `&[u8]` covering the entire size of a type, including padding b…

    borrowck_sacrifices crates.io
  • Low 2.1
    CVE-2025-62659

    The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki CookieConsent extension: fro…

    The Wikimedia Foundation MediaWiki CookieConsent extension Web / CMS
  • Low 2.3
    CVE-2025-11966

    Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names

    In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename…

    Eclipse Foundation Vert.x keycloak-26.4-iamguarded-compat strimzi-kafka-operator-kafka-thirdparty-libs-cc Wolfi Maven
  • Low 2.7
    CVE-2025-41721

    Sauter: Command Injection

    A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.

    Sauter modulo 6 devices modu660-AS EY-modulo 5 modu 5 modu524 EY-modulo 5 ecos 5 ecos504/505
  • Low 3.1
    CVE-2025-62772

    On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.

    Mercku M6a
  • Low 2.4
    CVE-2025-62773

    Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.

    Mercku M6a
  • Low 3.1
    CVE-2025-62774

    On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.

    Mercku M6a