Skip to content
OpenAdvisories

Archive

December 2025

Vulnerabilities first published in this month (UTC), newest first.

← November 2025 2025 / December January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-52691 Exploited · Ransomware Public exploit Scanner template EPSS 86%

    Upload Arbitrary Files

    Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

    SmarterTools SmarterMail
    KEV Jan 26, 2026
  • High 8.8
    CVE-2025-68645 Exploited Public exploit Scanner template EPSS 51%

    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1…

    KEV Jan 22, 2026
  • Critical 10.0
    CVE-2025-68613 Exploited Public exploit Scanner template EPSS 99%

    n8n Vulnerable to Remote Code Execution via Expression Injection

    n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions…

    n8n-io n8n n8n npm
    KEV Mar 11, 2026
  • High 7.5
    CVE-2025-14847 Exploited Public exploit Scanner template EPSS 83%

    Zlib compressed protocol header length confusion may allow memory read

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB…

    MongoDB MongoDB Server mongodb Ubuntu
    KEV Dec 29, 2025
  • Critical 9.3
    CVE-2025-14733 Exploited · Ransomware Public exploit EPSS 29%

    WatchGuard Firebox iked Out of Bounds Write Vulnerability

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when co…

    WatchGuard Fireware OS
    KEV Dec 19, 2025
  • Medium 6.6
    CVE-2025-40602 Exploited Public exploit

    A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance managem…

    SonicWall SMA1000 Network devices
    KEV Dec 17, 2025
  • High 7.2
    CVE-2025-68461 Exploited Public exploit EPSS 27%

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…

    Roundcube Webmail roundcube roundcube Debian Ubuntu
    KEV Feb 20, 2026
  • High 8.8
    CVE-2025-43529 Exploited Public exploit EPSS 26%

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 an…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
    KEV Dec 15, 2025
  • Critical 10.0
    CVE-2025-20393 Exploited Public exploit EPSS 32%

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

    A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root…

    Cisco Cisco Secure Email Cisco Secure Email and Web Manager Network devices
    KEV Dec 17, 2025
  • Critical 10.0
    CVE-2025-37164 Exploited Public exploit Scanner template EPSS 90%

    A remote code execution issue exists in HPE OneView.

    Hewlett Packard Enterprise (HPE) HPE OneView
    KEV Jan 7, 2026
  • High 7.1
    CVE-2025-14611 Exploited Public exploit Scanner template EPSS 53%

    Gladinet CentreStack and TrioFox Hard Coded AES Keys

    Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusio…

    Gladinet CentreStack and TrioFox
    KEV Dec 15, 2025
  • Medium 5.5
    CVE-2025-43520 Exploited Public exploit

    A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
    KEV Mar 20, 2026
  • High 8.8
    CVE-2025-14174 Exploited Public exploit EPSS 55%

    Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfo…

    Google Chrome chromium qtwebkit-source Browsers Debian Ubuntu Alpine Wolfi
    KEV Dec 12, 2025
  • High 8.7
    CVE-2025-8110 Exploited Public exploit Scanner template EPSS 80%

    File overwrite in file update API in Gogs

    Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

    Gogs Gogs gogs.io/gogs Go
    KEV Jan 12, 2026
  • High 7.8
    CVE-2025-62221 Exploited Public exploit

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Dec 9, 2025
  • Critical 9.1
    CVE-2025-59718 Exploited Public exploit EPSS 68%

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0…

    Fortinet FortiOS FortiProxy FortiSwitchManager Network devices
    KEV Dec 16, 2025
  • Critical 9.4
    CVE-2025-34291 Exploited Public exploit Scanner template EPSS 93%

    Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

    Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie c…

    Langflow Langflow langflow PyPI
    KEV May 21, 2026
  • Critical 10.0
    CVE-2025-55182 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    React Server Components are Vulnerable to RCE

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vul…

    Meta react-server-dom-turbopack react-server-dom-webpack react-server-dom-parcel npm
    KEV Dec 5, 2025