Skip to content
OpenAdvisories

Archive

2 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /2 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-13658

    Industrial Video & Control Longwatch has a Code Injection vulnerability

    A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.

    Industrial Video & Control Longwatch
  • Critical 9.3
    CVE-2025-13510

    Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy

    The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.

    Iskra iHUB and iHUB Lite
  • Critical 9.8
    CVE-2025-13542

    DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation

    The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it po…

    Design themes DesignThemes LMS Web / CMS
  • Critical 9.0
    CVE-2025-13828

    Mautic user without privileged access to the Marketplace can install and uninstall composer packages

    SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malic…

    Mautic Mautic mautic/core Packagist
  • Critical 9.4
    CVE-2025-11779

    Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50

    Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This new configuration function is activated by a management web request, which can be invoked by a user w…

    SGE-PLC1000 SGE-PLC50 Circutor
  • Critical 10.0
    CVE-2025-11778

    Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50

    Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation.

    SGE-PLC1000 SGE-PLC50 Circutor
  • Critical 9.8
    CVE-2025-41742

    Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components

    Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any de…

    Sprecher Automation SPRECON-E-C SPRECON-E-T3 SPRECON-E-P
  • Critical 9.1
    CVE-2025-41744

    Sprecher Automation: SPRECON-E series has static default key material for TLS connections

    Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.

    Sprecher Automation SPRECON-E-P SPRECON-E-C SPRECON-E-T3
  • Critical 9.1
    CVE-2025-59703

    Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 …

  • Critical 9.8
    CVE-2025-59693

    The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patc…

  • Critical 9.8
    CVE-2025-59695

    Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 …

  • Critical 9.8
    CVE-2025-60854 Public exploit

    A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter durin…

  • Critical 9.8
    CVE-2025-60736 Public exploit

    code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

  • Critical 9.8
    CVE-2025-58386

    In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper ser…

  • Critical 9.8
    CVE-2025-65358

    Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter a…

  • Critical 9.8
    CVE-2025-65896

    asyncmy is vulnerable to SQL injection via crafted dict keys

    SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.

    asyncmy PyPI
  • Critical 9.8
    CVE-2025-65656

    dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.