Skip to content
OpenAdvisories

Archive

9 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /9 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-67494 Public exploit

    ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

    ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, …

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • High 7.5
    CVE-2025-66645 Public exploit

    NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

    NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version …

    zauberzeug nicegui nicegui PyPI
  • Critical 9.3
    CVE-2025-66039 Public exploit

    FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

    FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a se…

    FreePBX framework
  • High 7.8
    CVE-2025-62221 Exploited Public exploit

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Dec 9, 2025
  • High 7.8
    CVE-2025-54100 Public exploit

    PowerShell Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.8
    CVE-2025-62470 Public exploit

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.8
    CVE-2025-62454 Public exploit

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Critical 9.1
    CVE-2025-59718 Exploited Public exploit EPSS 68%

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0…

    Fortinet FortiOS FortiProxy FortiSwitchManager Network devices
    KEV Dec 16, 2025
  • Medium 4.7
    CVE-2025-67586 Public exploit

    WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.

    Ronald Huereca Highlight and Share
  • High 7.3
    CVE-2025-14325 Public exploit

    JIT miscompilation in the JavaScript Engine: JIT component

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-14321 Public exploit

    Use-after-free in the WebRTC: Signaling component

    Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 6.1
    CVE-2025-66470 Public exploit

    NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

    NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows att…

    zauberzeug nicegui nicegui PyPI
  • Medium 5.4
    CVE-2025-65300 Public exploit

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-2…

  • Critical 9.8
    CVE-2025-65741 Public exploit

    Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file …