Skip to content
OpenAdvisories

Archive

5 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /5 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-64459 Public exploit EPSS 19%

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2025-12674 Public exploit

    KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

    The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbit…

    mykiot KiotViet Sync Web / CMS
  • Critical 9.8
    CVE-2025-11749 Public exploit Scanner template EPSS 75%

    AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

    The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for u…

    tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Web / CMS
  • Critical 9.8
    CVE-2025-12735 Public exploit

    CVE-2025-12735

    The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER …

    silentmatt expr-eval-fork expr-eval expr-eval-fork npm
  • Critical 9.8
    CVE-2025-61304 Public exploit

    OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.