Skip to content
OpenAdvisories

Archive

26 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /26 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 2.9
    CVE-2025-68932

    FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

    FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attacker…

    FreshRSS FreshRSS
  • Low 3.1
    CVE-2025-36229

    Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex

    IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.

    IBM Aspera Faspex 5
  • Low 3.8
    CVE-2025-36228

    Incorrect Execution-Assigned Permissions in IBM Aspera Faspex

    IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.

    IBM Aspera Faspex 5
  • Low 3.1
    CVE-2025-68940

    Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

    In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

    Gitea Gitea code.gitea.io/gitea Go
  • Low 3.5
    CVE-2025-15095

    postmanlabs httpbin core.py cross site scripting

    A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has b…

    postmanlabs httpbin