Skip to content
OpenAdvisories

Archive

7 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /7 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-10230 Public exploit EPSS 40%

    Samba: command injection in wins server hook script

    A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-12890 Public exploit

    Bluetooth: peripheral: Invalid handling of malformed connection request

    Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

    zephyrproject-rtos Zephyr
  • Critical 9.3
    CVE-2025-34299 Public exploit Scanner template EPSS 73%

    Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

    Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

    Monsta Limited of New Zealand Monsta FTP
  • High 8.6
    CVE-2025-64328 Exploited Public exploit Scanner template EPSS 85%

    FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

    FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an au…

    FreePBX filestore
    KEV Feb 3, 2026
  • Medium 4.1
    CVE-2025-63420 Public exploit

    CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created …

  • High 7.5
    CVE-2025-60574 Public exploit

    A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/style…