Skip to content
OpenAdvisories

Archive

19 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /19 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

52 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-12427

    YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename

    The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possi…

    YITHEMES YITH WooCommerce Wishlist Web / CMS
  • Medium 5.3
    CVE-2025-12770

    New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling

    The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using loose equality comparison. This makes it possible for unauthenticated attackers to…

    Saad Iqbal New User Approve Web / CMS
  • Medium 6.4
    CVE-2025-6251

    Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible …

    WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS
  • Medium 5.3
    CVE-2025-12777

    YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion

    The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/…

    YITHEMES YITH WooCommerce Wishlist Web / CMS
  • Medium 5.6
    CVE-2025-13225

    Tanium addressed an arbitrary file deletion vulnerability in TanOS.

    Tanium addressed an arbitrary file deletion vulnerability in TanOS.

    Tanium TanOS
  • Medium 6.1
    CVE-2025-63879

    A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0…

  • Medium 6.5
    CVE-2025-63214

    An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unaut…

  • Medium 6.1
    CVE-2025-63211

    Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.…

  • Medium 6.5
    CVE-2025-63212

    GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensit…

  • Medium 6.5
    CVE-2025-63878

    Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form pa…

  • Medium 4.6
    CVE-2025-63243

    A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25…

  • Medium 5.4
    CVE-2025-51662

    A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and e…