Skip to content
OpenAdvisories

Archive

11 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /11 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 5.5
    CVE-2025-12748 Public exploit

    Libvirt: denial of service in xml parsing

    A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2025-62222 Public exploit

    Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Visual Studio Code CoPilot Chat Extension
  • High 7.0
    CVE-2025-62215 Exploited Public exploit

    Windows Kernel Elevation of Privilege Vulnerability

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 12, 2025
  • High 7.0
    CVE-2025-60719 Public exploit

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.8
    CVE-2025-60710 Exploited · Ransomware Public exploit

    Host Process for Windows Tasks Elevation of Privilege Vulnerability

    Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
    KEV Apr 13, 2026
  • High 7.8
    CVE-2025-60709 Public exploit

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 6.7
    CVE-2025-31931 Public exploit

    Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 wi…

  • Medium 5.9
    CVE-2025-12101 Public exploit Scanner template EPSS 26%

    Cross-Site Scripting (XSS)

    Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

    NetScaler ADC Gateway
  • High 8.8
    CVE-2025-9223 Public exploit

    Command Injection

    Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

    Zohocorp ManageEngine Applications Manager
  • Critical 10.0
    CVE-2025-12539 Public exploit

    TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

    The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the w…

    leopardhost TNC Toolbox: Web Performance Web / CMS
  • Medium 5.3
    CVE-2025-11986 Public exploit

    Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State

    The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the registe…

    odude Crypto Tool Web / CMS
  • Critical 9.8
    CVE-2025-11170 Public exploit

    WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

    The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated at…

    kddiwebcommunications WP移行専用プラグイン for CPI Web / CMS
  • Medium 5.3
    CVE-2025-11988 Public exploit

    Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion

    The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows callin…

    odude Crypto Tool Web / CMS