Skip to content
OpenAdvisories

Archive

30 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /30 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 1.2
    CVE-2025-69210 Public exploit

    FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files co…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 7.5
    CVE-2025-69256 Public exploit

    serverless MCP Server vulnerable to command injection in list-projects tool

    The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP se…

    serverless serverless serverless npm
  • Critical 9.8
    CVE-2025-68926 Public exploit EPSS 32%

    RustFS has a gRPC Hardcoded Token Authentication Bypass

    RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both cli…

    rustfs rustfs rustfs crates.io
  • Low 3.8
    CVE-2025-69015 Public exploit

    WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

    Automattic Crowdsignal Forms
  • High 7.5
    CVE-2025-66723 Public exploit

    inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Libra…

  • Medium 6.5
    CVE-2025-65925 Public exploit

    An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts t…