Skip to content
OpenAdvisories

Archive

21 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /21 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-65108

    md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

    md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in t…

    simonhaenisch md-to-pdf md-to-pdf npm
  • Critical 9.1
    CVE-2025-64767

    hpke-js reuses AEAD nonces

    hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This c…

    dajiaji hpke-js @hpke/core npm
  • Critical 10.0
    CVE-2025-41115 Public exploit EPSS 17%

    Incorrect privilege assignment

    SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled an…

    Grafana Grafana Enterprise github.com/grafana/grafana Web / CMS Go
  • Critical 9.8
    CVE-2025-11127

    Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation

    The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing th…

    Web / CMS
  • Critical 9.8
    CVE-2025-11456

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possib…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 9.8
    CVE-2025-64310

    EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attem…

    Seiko Epson EPSON WebConfig for SEIKO EPSON Projector Products Epson Web Control for SEIKO EPSON Projector Products