Skip to content
OpenAdvisories

Archive

29 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /29 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.7
    CVE-2025-66289

    OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

    OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indef…

    orangehrm orangehrm
  • High 8.7
    CVE-2025-66225

    OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

    OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally in…

    orangehrm orangehrm
  • High 8.4
    CVE-2025-66223

    OpenObserve's Invite Token Lifecycle Misconfiguration

    OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same emai…

    openobserve openobserve
  • High 7.2
    CVE-2025-53899

    Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on th…

    Kiteworks security-advisories
  • High 7.1
    CVE-2025-53896

    Kiteworks MFT is vulnerable to Insufficient Session Expiration

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in ve…

    Kiteworks security-advisories
  • High 8.8
    CVE-2025-66217

    AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow

    AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQT…

    jvde-github AIS-catcher
  • High 8.6
    CVE-2025-66201

    LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability

    LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use those actions. It coul…

    danny-avila LibreChat
  • High 7.1
    CVE-2025-66027

    Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings

    Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even…

    lukevella rallly