Skip to content
OpenAdvisories

Archive

26 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /26 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.4
    CVE-2025-62593 Exploited Public exploit Scanner template EPSS 60%

    Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

    Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-ba…

    ray-project ray airflow-3 ray Wolfi PyPI
    KEV Aug 17, 2026
  • Critical 9.8
    CVE-2025-59390 Public exploit

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Critical 9.8
    CVE-2025-50433 Public exploit

    An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted …

  • Critical 9.1
    CVE-2025-65669 Public exploit

    An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page withou…

  • Medium 5.4
    CVE-2025-65676 Public exploit

    Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arb…

  • Medium 5.4
    CVE-2025-65675 Public exploit

    Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arb…

  • High 7.5
    CVE-2025-65672 Public exploit

    Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course set…

  • Low 3.3
    CVE-2025-65681 Public exploit

    Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control

    An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.

    tutor PyPI
  • Medium 4.3
    CVE-2025-65670 Public exploit

    An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endp…