Skip to content
OpenAdvisories

Archive

November 2025

Vulnerabilities first published in this month (UTC), newest first.

← October 2025 2025 / November December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.2
    CVE-2025-58360 Exploited Public exploit Scanner template EPSS 61%

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
    KEV Dec 11, 2025
  • High 7.0
    CVE-2025-62215 Exploited Public exploit

    Windows Kernel Elevation of Privilege Vulnerability

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 12, 2025
  • High 7.8
    CVE-2025-60710 Exploited · Ransomware Public exploit

    Host Process for Windows Tasks Elevation of Privilege Vulnerability

    Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
    KEV Apr 13, 2026
  • High 8.6
    CVE-2025-64328 Exploited Public exploit Scanner template EPSS 85%

    FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

    FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an au…

    FreePBX filestore
    KEV Feb 3, 2026