Skip to content
OpenAdvisories

Archive

13 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /13 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 2.7
    CVE-2025-64754

    Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

    Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are…

    Jitsi jitsi-meet
  • Low 3.5
    CVE-2025-64744

    OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails

    OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is ins…

    openobserve openobserve
  • Low 2.7
    CVE-2025-64745

    Astro development server error page vulnerable to reflected Cross-site Scripting

    Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can injec…

    withastro astro astro npm
  • Low 3.3
    CVE-2025-46370

    Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low p…

    Dell Alienware Command Center 6.x (AWCC)
  • Low 3.1
    CVE-2025-11777

    Cross-team channel membership access

    Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the …

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.1
    CVE-2025-12817

    PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

    Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privile…

    postgresql15 postgresql-15 postgresql16 postgresql-9.3 Debian Ubuntu Azure Linux Alpine
  • Low 3.9
    CVE-2025-64711

    PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users

    PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any us…

    PrivateBin PrivateBin privatebin/privatebin Packagist