Skip to content
OpenAdvisories

Archive

23 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /23 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 4.8
    CVE-2025-54856

    Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored …

    Six Apart Movable Type Premium Cloud Edition Movable Type Cloud Edition Movable Type Advanced (Software Edition)
  • Medium 5.5
    CVE-2025-48430

    Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Com…

    Gallagher Command Centre Server
  • Medium 6.7
    CVE-2025-48428

    Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated u…

    Gallagher Command Centre Server
  • Medium 5.5
    CVE-2025-41402

    Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to …

    Gallagher Command Centre Server
  • Medium 5.5
    CVE-2025-35981

    Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privi…

    Gallagher Command Centre Server
  • Medium 4.9
    CVE-2025-62820

    Slack Nebula may accept arbitrary source IP addresses

    Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

    Slack Nebula step step-issuer Wolfi Go
  • Medium 6.5
    CVE-2025-50951

    FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.

    fontforge fontforge Debian Ubuntu
  • Medium 6.5
    CVE-2025-50949

    FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

    fontforge fontforge Debian Ubuntu
  • Medium 6.5
    CVE-2025-61464

    gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.p…

  • Medium 6.1
    CVE-2025-61413

    Piranha CMS vulnerable to stored cross-site scripting (XSS)

    A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.

    Piranha NuGet
  • Medium 6.1
    CVE-2025-60837

    MCMS reflected cross-site scripting (XSS) vulnerability

    A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.

    net.mingsoft:ms-mcms Maven
  • Medium 6.5
    CVE-2025-60852 Public exploit

    A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built w…

  • Medium 6.1
    CVE-2025-60859

    Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code vi…

  • Medium 6.1
    CVE-2025-57240

    Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute a…

  • Medium 6.5
    CVE-2025-54963

    An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Serv…

  • Medium 4.3
    CVE-2025-54966

    An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return …

  • Medium 6.5
    CVE-2025-56007

    CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding add…

  • Medium 5.3
    CVE-2025-56009

    Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to tak…

  • Medium 6.1
    CVE-2025-56008

    Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near …