Skip to content
OpenAdvisories

Archive

5 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /5 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.4
    CVE-2025-34291 Exploited Public exploit Scanner template EPSS 93%

    Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

    Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie c…

    Langflow Langflow langflow PyPI
    KEV May 21, 2026
  • High 8.3
    CVE-2025-58098 Public exploit

    Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2025-12189 Public exploit

    Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload

    The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce va…

    Bread & Butter Bread & Butter: AI-Powered Lead Intelligence Web / CMS
  • Medium 6.4
    CVE-2025-12163 Public exploit

    Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting

    The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi…

    omnipressteam Omnipress Web / CMS