Skip to content
OpenAdvisories

Archive

14 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /14 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-67901

    openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSE…

    kristapsdz openrsync
  • Medium 4.3
    CVE-2025-14692

    Mayan EDMS authentication redirect

    A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used.…

    Mayan EDMS mayan-edms PyPI
  • Medium 4.3
    CVE-2025-14691

    Mayan EDMS authentication cross site scripting

    A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be …

    Mayan EDMS mayan-edms PyPI
  • Medium 4.5
    CVE-2025-67898

    MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

    MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.

    MJML MJML jitsucom-jitsu-console mjml Wolfi npm
  • Medium 5.8
    CVE-2025-13281

    Portworx Half-Blind SSRF in kube-controller-manager

    A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control pl…

    Kubernetes Kubernetes kots argocd-image-updater Debian Azure Linux Wolfi Go
  • Medium 6.3
    CVE-2025-14674

    aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injection

    A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngi…

    aizuda snail-job com.aizuda:snail-job Maven
  • Medium 5.6
    CVE-2025-14660

    DecoCMS Mesh Workspace Domain api.ts createTool access control

    A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argument domain causes impr…

    DecoCMS Mesh
  • Medium 4.7
    CVE-2025-14648

    DedeBIZ catalog_add.php command injection

    A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalog_add.php. Such manipulation leads to command injection. It is possible to launch the attack remotely. T…

  • Medium 5.3
    CVE-2025-12696

    HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset

    The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them

    Web / CMS
  • Medium 6.4
    CVE-2025-12537

    Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it po…

    WPVibes Addon Elements for Elementor (formerly Elementor Addon Elements) Web / CMS
  • Medium 5.3
    CVE-2025-67897

    Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short

    In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.

    sequoia-pgp sequoia rpm-sequoia rust-sequoia-openpgp Debian Ubuntu Wolfi crates.io
  • Medium 4.7
    CVE-2025-14642

    code-projects Computer Laboratory System technical_staff_pic.php unrestricted upload

    A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The…

    code-projects Computer Laboratory System
  • Medium 4.7
    CVE-2025-14641

    code-projects Computer Laboratory System admin_pic.php unrestricted upload

    A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the file admin/admin_pic.php. This manipulation of the argument image causes unrestricted upload. The attack may be initiated remotely. The ex…

    code-projects Computer Laboratory System