Skip to content
OpenAdvisories

Archive

19 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /19 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.0
    CVE-2025-11001 Public exploit EPSS 27%

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability bu…

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • High 8.7
    CVE-2025-65094 Public exploit

    WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

    WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to…

    WBCE WBCE_CMS
  • High 8.2
    CVE-2025-13316 Public exploit

    Hard-coded encryption keys in Twonky Server

    Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and…

    Lynxtechnology Twonky Server
  • Critical 9.3
    CVE-2025-13315 Public exploit Scanner template EPSS 31%

    Unauthenticated log access in Twonky Server

    Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

    Lynxtechnology Twonky Server
  • High 7.7
    CVE-2025-65099 Public exploit

    Claude Code vulnerable to command execution prior to startup trust dialog

    Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Ex…

    anthropics claude-code @anthropic-ai/claude-code npm