Skip to content
OpenAdvisories

Archive

25 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /25 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

56 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-12043

    Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update

    The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_auycht_saveCid' AJAX endpoint in all versions up to, and including, 1.1.9. This makes it possi…

    autochat Autochat Automatic Conversation Web / CMS
  • Medium 6.9
    CVE-2025-59365

    A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigg…

    ASUS Router
  • Medium 6.5
    CVE-2025-13644

    MongoDB may be susceptible to Invariant Failure due to batched delete

    MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSi…

    MongoDB MongoDB Server
  • Medium 4.2
    CVE-2025-12893

    Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

    Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsag…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2025-13507

    Time-series operations may cause internal BSON size limit to be exceed

    Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions…

    MongoDB MongoDB Server
  • Medium 5.4
    CVE-2025-13558

    Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing

    The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it po…

    pr-gateway Blog2Social: Social Media Auto Post & Scheduler Web / CMS
  • Medium 5.2
    CVE-2025-64730

    Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary …

    Sony SNC-CX600W
  • Medium 4.0
    CVE-2025-64304

    "FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptogr…

    Fuji Television Network "FOD" App for iOS "FOD" App for Android Android iOS
  • Medium 4.3
    CVE-2025-10646

    Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API

    The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated a…

    quadlayers Search Exclude Web / CMS
  • Medium 5.1
    CVE-2025-65944

    Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

    Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Co…

    getsentry sentry-javascript @sentry/nextjs @sentry/astro npm
  • Medium 4.3
    CVE-2025-64061

    Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access co…

  • Medium 5.3
    CVE-2025-64067

    Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profile…

  • Medium 4.8
    CVE-2025-64049

    REDAXO CMS is vulnerable to XSS through its module management component

    A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an ar…

    redaxo/source Packagist
  • Medium 6.1
    CVE-2025-63735 Public exploit

    A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the t…

  • Medium 6.5
    CVE-2025-61167

    SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php …

  • Medium 4.3
    CVE-2025-65647

    Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows inf…