Skip to content
OpenAdvisories

Archive

17 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /17 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Low 2.7
    CVE-2025-14836

    ZZCMS User Data Storage user_save.php cleartext storage in file

    A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of t…

  • Low 2.0
    CVE-2025-68399

    ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php

    ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting (XSS) vulnerability within the GroupEditor.php page of the application. When a user attempts to create a group role, they can execute mali…

    ChurchCRM CRM
  • Low 3.1
    CVE-2025-43531

    A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS …

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  • Low 3.7
    CVE-2025-55254

    HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)

    Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

    HCL Software BigFix Remote Control
  • Low 1.7
    CVE-2025-66647

    RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass

    RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07.…

    RIOT-OS RIOT
  • Low 1.7
    CVE-2025-66646

    RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass

    RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07.…

    RIOT-OS RIOT
  • Low 3.9
    CVE-2025-13326

    Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

    Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

    Mattermost Mattermost
  • Low 3.7
    CVE-2025-13324

    Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

    Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker w…

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.3
    CVE-2025-13321

    Mattermost Desktop App logging sensitive information and fails to clear data on server deletion

    Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the a…

    Mattermost Mattermost mattermost-desktop npm
  • Low 0.6
    CVE-2025-14266

    CSRF in Ercom Cryptobox administration console

    CSRF in Ercom Cryptobox administration console allows attacker to trigger some actions on behalf of a Cryptobox administrator. The attack requires the administrator to browse a malicious web site or to click a link while he has an open session on the administ…

    Ercom Cryptobox
  • Low 3.1
    CVE-2025-62690

    Open redirect in error page when link opened in new tab

    Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 3.0
    CVE-2025-13352

    Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

    Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objec…

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Low 2.4
    CVE-2025-14801

    xiweicheng TMS create createComment cross site scripting

    A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such manipulation of the argument content leads to cross site scripting. The attack may be performed fro…

    xiweicheng TMS
  • Low 2.8
    CVE-2025-65185

    There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enum…