Skip to content
OpenAdvisories

Archive

December 2025

Vulnerabilities first published in this month (UTC), newest first.

← November 2025 2025 / December January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-65346 Public exploit

    alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

    alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction path…

    alexusmai/laravel-file-manager Packagist
  • Critical 10.0
    CVE-2025-55182 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    React Server Components are Vulnerable to RCE

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vul…

    Meta react-server-dom-turbopack react-server-dom-webpack react-server-dom-parcel npm
    KEV Dec 5, 2025
  • Critical 10.0
    CVE-2025-13390 Public exploit Scanner template

    WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

    The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the fea…

    listingthemes WP Directory Kit Web / CMS
  • Critical 9.8
    CVE-2025-13342 Public exploit Scanner template

    Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

    The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOpti…

    shabti Frontend Admin by DynamiApps Web / CMS
  • Critical 9.8
    CVE-2025-13486 Public exploit Scanner template EPSS 69%

    Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

    The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func…

    hwk-fr Advanced Custom Fields: Extended Web / CMS
  • Critical 9.8
    CVE-2025-60854 Public exploit

    A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter durin…

  • Critical 9.8
    CVE-2025-60736 Public exploit

    code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

  • Critical 9.0
    CVE-2025-3500 Public exploit

    Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation

    Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.

    Avast Antivirus