Skip to content
OpenAdvisories

Archive

2 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /2 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Low 3.5
    CVE-2025-13640

    Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass au…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Low 2.7
    CVE-2025-66409

    ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to acce…

    espressif esp-idf
  • Low 2.1
    CVE-2025-13872

    Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio

    Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

    ObjectPlanet Opinio
  • Low 2.3
    CVE-2025-13871

    The feature to manage resources is prone to Cross-Site Request Forgery attacks

    Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.

    ObjectPlanet Opinio
  • Low 3.1
    CVE-2025-13870

    Unauthorized access and subscription vulnerability in Boards

    Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the blo…

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.4
    CVE-2025-20769

    In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …

    MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985
  • Low —
    GHSA-mj73-j457-8x9q

    maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe

    maxminddb prior to version 0.27 declared `Reader::open_mmap` as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while …

    maxminddb crates.io
  • Low —
    GHSA-pq5v-rwp8-p7gm

    rtvm-interpreter lacks sufficient checks in public API

    The affected function is unsound due to insufficient checks on public struct field.

    rtvm-interpreter crates.io
  • Low 3.2
    CVE-2025-59696

    Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 …

  • Low 3.5
    CVE-2025-65858 Public exploit

    Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

    A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is …

    calibreweb PyPI