CVEs published November 5, 2025
102 CVEs were published on November 5, 2025: 16 critical, 27 high. 1 is now in CISA KEV.
- Published
- 102
- Critical
- 16
- High
- 27
- Medium
- 58
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 29
Most affected products
- Dell CloudLink
- 6
- Cisco Identity Services Engine Software
- 5
- Cisco Unified Contact Center Express
- 5
- Entr'ouvert Lasso
- 4
- mykiot KiotViet Sync
- 4
- Samsung Mobile Devices
- 4
- amans2k FunnelKit Automations – Email Marketing Automation…
- 2
- djangoproject Django · django
- 2
- stellarwp The Events Calendar
- 2
- youki-dev youki · youki
- 2
Critical 16
- CVE-2025-46364Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape VulnerabilitDell CloudLin
- CVE-2025-20358Cisco Unified Contact Center Express Editor Authentication Bypass VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20354Cisco Unified Contact Center Express Remote Code Execution VulnerabilityCisco Unified Contact Center Express
- CVE-2025-45378Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell.Dell CloudLink
- CVE-2025-64459Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject Django · django
- CVE-2025-47151A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2.Entr'ouvert Lasso
- CVE-2025-55108BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code executionBMC Control-M/Agent
- CVE-2025-12674KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Uploadmykiot KiotViet Sync
- CVE-2025-11749AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalationtigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2025-12735CVE-2025-12735silentmatt expr-eval · expr-eval-fork +1
- CVE-2025-55343Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/b
- CVE-2025-56231Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass upda
- CVE-2025-61304OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.
- CVE-2025-63334PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php compo
- CVE-2025-63416** exclusively-hosted-service ** A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3
- CVE-2025-63601Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious bac
High 27
- CVE-2025-64163DataEase's DB2 is vulnerable to SSRFdataease
- CVE-2025-62596youki container escape and denial of service due to arbitrary write gadgets and procfs write redirectsyouki-dev youki · youki
- CVE-2025-62161youki container escape via "masked path" abuse due to mount race conditionsyouki-dev youki · youki
- CVE-2025-55278HCL DevOps Loop is susceptible to an improper authentication vulnerabilityHCL Software DevOps Loop
- CVE-2025-12779Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authAmazon WorkSpaces
- CVE-2023-43000A use-after-free issue was addressed with improved memory management.Apple macOS · Apple iOS and iPadOS +1
- CVE-2025-11093Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)WSO2 Micro Integrator · WSO2 API Manager +9
- CVE-2025-10907Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionWSO2 API Manager · WSO2 Open Banking IAM +15
- CVE-2025-43990Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability.Dell Command Monitor
- CVE-2025-45379Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from coDell CloudLink
- CVE-2025-20343Cisco Identity Services Engine Radius Suppression Denial of Service VulnerabilityCisco Identity Services Engine Software
- CVE-2025-30479Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gainDell CloudLink
- CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windowsdjangoproject Django · django
- CVE-2025-46404A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1.Entr'ouvert Lasso
- CVE-2025-46784A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1.Entr'ouvert Lasso
- CVE-2025-46705A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2.Entr'ouvert Lasso
- CVE-2025-12497Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]averta Premium Portfolio Features for Phlox theme
- CVE-2025-10622Foreman: os command injection via ct_location and fcct_location parametersThe Foreman Foreman · Red Hat Satellite 6.15 for RHEL +4
- CVE-2025-12384Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulationbplugins Document Embedder – Embed PDFs, Word, Excel, and O…
- CVE-2025-12139File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposureprinceahmed File Manager for Google Drive – Integrate Googl…
- CVE-2025-21079Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrarySamsung Mobile Samsung Members
- CVE-2025-21078Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data frSamsung Mobile Smart Switch
- CVE-2025-12197The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via sstellarwp The Events Calendar
- CVE-2025-57130An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker
- CVE-2025-61084MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA.
- CVE-2025-63248DWSurvey 6.14.0 is vulnerable to Incorrect Access Control.
- CVE-2025-63417A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers t
Medium, low and unrated 59
- CVE-2025-64114ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields pluginMacWarrior clipbucket-v5
- CVE-2025-10853Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingWSO2 Open Banking IAM · WSO2 API Manager +10
- CVE-2025-5770Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 ProductsWSO2 Identity Server · WSO2 API Manager +1
- CVE-2025-43418This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2025-12745QuickJS quickjs.c js_array_buffer_slice buffer over-readQuickJS
- CVE-2025-31954HCL iAutomate is susceptible to a sensitive information disclosureHCL Software iAutomate
- CVE-2025-10713XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationWSO2 Enterprise Integrator · WSO2 API Control Plane +7
- CVE-2025-46366Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation Dell CloudLink
- CVE-2025-46424Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability.Dell CloudLink
- CVE-2025-46365Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to causeDell CloudLink
- CVE-2025-20304Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2025-20305A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive informaCisco Identity Services Engine Software
- CVE-2025-20289Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2025-20303Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2025-20377Cisco Unified Intelligence Center API Information Disclosure VulnerabilityCisco Packaged Contact Center Enterprise · Cisco Unified… +2
- CVE-2025-20375Cisco Unified Contact Center Express Arbitrary File Upload VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20376Cisco Unified Contact Center Express Remote Code Execution VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20374Cisco Unified Contact Center Express Arbitrary File Download VulnerabilityCisco Unified Contact Center Express
- CVE-2025-3125Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionWSO2 Identity Server · WSO2 Enterprise Integrator +6
- CVE-2025-52602HCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query applicationHCL Software BigFix Query
- CVE-2025-11745Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fieldspacetime Ad Inserter – Ad Manager & AdSense Ads
- CVE-2025-12192The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposurestellarwp The Events Calendar
- CVE-2025-12469FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sendingamans2k FunnelKit Automations – Email Marketing Automation…
- CVE-2025-11987Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcodebrechtvds Visual Link Preview
- CVE-2025-12468FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposureamans2k FunnelKit Automations – Email Marketing Automation…
- CVE-2025-11820Graphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgetsiqonicdesign Graphina – Charts and Graphs For Elementor
- CVE-2025-58337Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP ServerApache Software Foundation Apache Doris-MCP-Server · doris-…
- CVE-2025-12675KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Updatemykiot KiotViet Sync
- CVE-2025-12676KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypassmykiot KiotViet Sync
- CVE-2025-12677KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposuremykiot KiotViet Sync
- CVE-2025-12388B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgerybplugins Carousel Block – Responsive Image and Content Caro…
- CVE-2025-11373Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Uploadaverta Depicter — Popup & Slider Builder
- CVE-2025-11917WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feedetruel WPeMatico RSS Feed Fetcher
- CVE-2025-62225Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path.Sony Optical Disc Archive Software
- CVE-2025-64151Multiple Roboticsware products provided by Roboticsware PTE.Roboticsware PTE. FA-Panel6 · Roboticsware PTE. BA-Panel6 +2
- CVE-2025-6027Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password RestAce User Management
- CVE-2025-11072Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File DownloadMelAbu WP Download Counter Button
- CVE-2025-10873Elementinvader Addons for Elementor < 1.4.1 – Unauthenticated Arbitrary Email SendingElementInvader Addons for Elementor
- CVE-2025-10567FunnelKit < 3.12.0.1 - Reflected XSSFunnelKit
- CVE-2025-21077Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email Samsung Mobile Samsung Email
- CVE-2025-21076Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access Samsung Mobile Samsung Account
- CVE-2025-21075Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-21074Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-21073Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user daSamsung Mobile Devices
- CVE-2025-21071Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write ouSamsung Mobile Devices
- CVE-2025-11162Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSSbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2025-11835Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewalcozmoslabs Paid Membership Subscriptions – Effortless Membe…
- CVE-2025-12580SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scriptingstanleychoi SMS for WordPress
- CVE-2025-12582Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Resetklicher Features
- CVE-2025-8871Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form SignatureWPEverest Everest Forms Pro
- CVE-2025-55341Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad.
- CVE-2025-55342Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users vi
- CVE-2025-56232GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation.
- CVE-2025-57244OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface.
- CVE-2025-59716ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint.
- CVE-2025-60753An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted
- CVE-2025-60784A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.
- CVE-2025-63418A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the
- CVE-2025-63585OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.