Skip to content
OpenAdvisories

Archive

28 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /28 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

28 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-13683

    Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affe…

    Devolutions Server Remote Desktop Manager
  • Medium 5.9
    CVE-2025-11156

    Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver

    Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers…

    Netskope Netskope Client
  • Medium 5.3
    CVE-2025-59792

    Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins

    Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.

    Apache Software Foundation Apache Kvrocks
  • Medium 5.4
    CVE-2025-59790

    Apache Kvrocks: RESET command grants admin privileges

    Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.

    Apache Software Foundation Apache Kvrocks
  • Medium 6.1
    CVE-2025-12143

    Stack Memory Corruption Vulnerability

    Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.

    ABB Terra AC wallbox ICS / OT
  • Medium 6.5
    CVE-2025-13771

    Uniong｜WebITR - Arbitrary File Read

    WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

    Uniong WebITR
  • Medium 6.5
    CVE-2025-13770

    Uniong｜WebITR - SQL Injection

    WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

    Uniong WebITR
  • Medium 6.5
    CVE-2025-13769

    Uniong｜WebITR - SQL Injection

    WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

    Uniong WebITR
  • Medium 4.3
    CVE-2025-13737

    Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login

    The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for …

    nextendweb Nextend Social Login and Register Web / CMS
  • Medium 4.9
    CVE-2025-64312

    Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability m…

    Huawei HarmonyOS Network devices
  • Medium 5.8
    CVE-2025-58311

    UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availabil…

    Huawei HarmonyOS EMUI Network devices
  • Medium 6.2
    CVE-2025-58305

    Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability …

    Huawei HarmonyOS Network devices
  • Medium 4.9
    CVE-2025-58304

    Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability m…

    Huawei HarmonyOS Network devices
  • Medium 6.2
    CVE-2025-58294

    Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect …

    Huawei HarmonyOS Network devices
  • Medium 5.3
    CVE-2025-64313

    Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …

    Huawei HarmonyOS Network devices
  • Medium 5.1
    CVE-2025-64311

    Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affec…

    Huawei HarmonyOS Network devices
  • Medium 5.5
    CVE-2025-58315

    Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect …

    Huawei HarmonyOS Network devices
  • Medium 6.6
    CVE-2025-58314

    Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulne…

    Huawei HarmonyOS EMUI Network devices
  • Medium 5.1
    CVE-2025-58312

    Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affe…

    Huawei HarmonyOS Network devices
  • Medium 6.8
    CVE-2025-58309

    Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability …

    Huawei HarmonyOS Network devices
  • Medium 6.4
    CVE-2025-58307

    UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may a…

    Huawei HarmonyOS Network devices
  • Medium 4.4
    CVE-2025-64315

    Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability…

    Huawei HarmonyOS Network devices
  • Medium 5.0
    CVE-2025-66370

    Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible t…

    kivitendo kivitendo
  • Medium 5.0
    CVE-2025-66371

    Peppol-py is vulnerable to XXE attacks due to Saxon configuration

    Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.

    iteras Peppol-py peppol-py PyPI
  • Medium 4.1
    CVE-2025-66386

    app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.

    MISP MISP
  • Medium 5.5
    CVE-2025-51733

    Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

  • Medium 5.4
    CVE-2025-51734

    Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

  • Medium 6.3
    CVE-2025-51736

    File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.