Skip to content
OpenAdvisories

Archive

November 2025

Vulnerabilities first published in this month (UTC), newest first.

← October 2025 2025 / November December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.4
    CVE-2025-62593 Exploited Public exploit Scanner template EPSS 60%

    Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

    Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-ba…

    ray-project ray airflow-3 ray Wolfi PyPI
    KEV Aug 17, 2026
  • High 8.2
    CVE-2025-58360 Exploited Public exploit Scanner template EPSS 61%

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
    KEV Dec 11, 2025
  • Medium 6.7
    CVE-2025-58034 Exploited Public exploit EPSS 55%

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vu…

    Fortinet FortiWeb Network devices
    KEV Nov 18, 2025
  • High 8.8
    CVE-2025-13223 Exploited

    Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap cor…

    Google Chrome chromium chromium Browsers Debian Wolfi
    KEV Nov 19, 2025
  • Critical 9.4
    CVE-2025-64446 Exploited Public exploit Scanner template EPSS 91%

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWe…

    Fortinet FortiWeb Network devices
    KEV Nov 14, 2025
  • High 7.0
    CVE-2025-62215 Exploited Public exploit

    Windows Kernel Elevation of Privilege Vulnerability

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 12, 2025
  • High 7.8
    CVE-2025-60710 Exploited · Ransomware Public exploit

    Host Process for Windows Tasks Elevation of Privilege Vulnerability

    Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
    KEV Apr 13, 2026
  • Critical 9.1
    CVE-2025-12480 Exploited Scanner template EPSS 96%

    Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to ini…

    TrioFox TrioFox
    KEV Nov 12, 2025
  • High 8.6
    CVE-2025-64328 Exploited Public exploit Scanner template EPSS 85%

    FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

    FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an au…

    FreePBX filestore
    KEV Feb 3, 2026
  • High 8.8
    CVE-2023-43000 Exploited

    A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16…

    Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
    KEV Mar 5, 2026
  • Critical 9.8
    CVE-2025-11953 Exploited Public exploit Scanner template EPSS 94%

    Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

    The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST r…

    @react-native-community/cli-server-api @react-native-community/cli npm
    KEV Feb 5, 2026