# CVEs published 2025-11-05

102 CVEs were published on November 5, 2025: 16 critical, 27 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-64163](https://cve.now/CVE-2025-64163.md): DataEase's DB2 is vulnerable to SSRF (CVSS 8.9, dataease)
- [CVE-2025-64114](https://cve.now/CVE-2025-64114.md): ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin (CVSS 6.5, MacWarrior clipbucket-v5)
- [CVE-2025-62596](https://cve.now/CVE-2025-62596.md): youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVSS 7.3, youki-dev youki · youki)
- [CVE-2025-62161](https://cve.now/CVE-2025-62161.md): youki container escape via "masked path" abuse due to mount race conditions (CVSS 7.3, youki-dev youki · youki)
- [CVE-2025-55278](https://cve.now/CVE-2025-55278.md): HCL DevOps Loop is susceptible to an improper authentication vulnerability (CVSS 8.1, HCL Software DevOps Loop)
- [CVE-2025-12779](https://cve.now/CVE-2025-12779.md): Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the auth (CVSS 8.8, Amazon WorkSpaces)
- [CVE-2025-10853](https://cve.now/CVE-2025-10853.md): Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding (CVSS 5.2, WSO2 Open Banking IAM · WSO2 API Manager +10)
- [CVE-2025-5770](https://cve.now/CVE-2025-5770.md): Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products (CVSS 6.1, WSO2 Identity Server · WSO2 API Manager +1)
- [CVE-2025-43418](https://cve.now/CVE-2025-43418.md): This issue was addressed by restricting options offered on a locked device. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2023-43000](https://cve.now/CVE-2023-43000.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, KEV, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2025-12745](https://cve.now/CVE-2025-12745.md): QuickJS quickjs.c js\_array\_buffer\_slice buffer over-read (CVSS 4.8, QuickJS)
- [CVE-2025-11093](https://cve.now/CVE-2025-11093.md): Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) (CVSS 8.4, WSO2 Micro Integrator · WSO2 API Manager +9)
- [CVE-2025-31954](https://cve.now/CVE-2025-31954.md): HCL iAutomate is susceptible to a sensitive information disclosure (CVSS 5.4, HCL Software iAutomate)
- [CVE-2025-10907](https://cve.now/CVE-2025-10907.md): Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution (CVSS 8.4, WSO2 API Manager · WSO2 Open Banking IAM +15)
- [CVE-2025-10713](https://cve.now/CVE-2025-10713.md): XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration (CVSS 6.5, WSO2 Enterprise Integrator · WSO2 API Control Plane +7)
- [CVE-2025-43990](https://cve.now/CVE-2025-43990.md): Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. (CVSS 7.3, Dell Command Monitor)
- [CVE-2025-46366](https://cve.now/CVE-2025-46366.md): Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation (CVSS 6.7, Dell CloudLink)
- [CVE-2025-46424](https://cve.now/CVE-2025-46424.md): Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. (CVSS 6.7, Dell CloudLink)
- [CVE-2025-46365](https://cve.now/CVE-2025-46365.md): Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause (CVSS 5.3, Dell CloudLink)
- [CVE-2025-46364](https://cve.now/CVE-2025-46364.md): Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerabilit (CVSS 9.1, Dell CloudLin)
- [CVE-2025-20304](https://cve.now/CVE-2025-20304.md): Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2025-20305](https://cve.now/CVE-2025-20305.md): A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive informa (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2025-20289](https://cve.now/CVE-2025-20289.md): Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2025-20303](https://cve.now/CVE-2025-20303.md): Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2025-45379](https://cve.now/CVE-2025-45379.md): Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from co (CVSS 8.4, Dell CloudLink)
- [CVE-2025-20377](https://cve.now/CVE-2025-20377.md): Cisco Unified Intelligence Center API Information Disclosure Vulnerability (CVSS 4.3, Cisco Packaged Contact Center Enterprise · Cisco Unified… +2)
- [CVE-2025-20375](https://cve.now/CVE-2025-20375.md): Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability (CVSS 6.5, Cisco Unified Contact Center Express)
- [CVE-2025-20376](https://cve.now/CVE-2025-20376.md): Cisco Unified Contact Center Express Remote Code Execution Vulnerability (CVSS 6.5, Cisco Unified Contact Center Express)
- [CVE-2025-20374](https://cve.now/CVE-2025-20374.md): Cisco Unified Contact Center Express Arbitrary File Download Vulnerability (CVSS 4.9, Cisco Unified Contact Center Express)
- [CVE-2025-20358](https://cve.now/CVE-2025-20358.md): Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability (CVSS 9.4, Cisco Unified Contact Center Express)
- [CVE-2025-20354](https://cve.now/CVE-2025-20354.md): Cisco Unified Contact Center Express Remote Code Execution Vulnerability (CVSS 9.8, Cisco Unified Contact Center Express)
- [CVE-2025-20343](https://cve.now/CVE-2025-20343.md): Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability (CVSS 8.6, Cisco Identity Services Engine Software)
- [CVE-2025-30479](https://cve.now/CVE-2025-30479.md): Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain (CVSS 8.4, Dell CloudLink)
- [CVE-2025-45378](https://cve.now/CVE-2025-45378.md): Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. (CVSS 9.1, Dell CloudLink)
- [CVE-2025-64459](https://cve.now/CVE-2025-64459.md): Potential SQL injection via \_connector keyword argument in QuerySet and Q objects (CVSS 9.1, djangoproject Django · django)
- [CVE-2025-64458](https://cve.now/CVE-2025-64458.md): Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows (CVSS 7.5, djangoproject Django · django)
- [CVE-2025-47151](https://cve.now/CVE-2025-47151.md): A type confusion vulnerability exists in the lasso\_node\_impl\_init\_from\_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. (CVSS 9.8, Entr'ouvert Lasso)
- [CVE-2025-46404](https://cve.now/CVE-2025-46404.md): A denial of service vulnerability exists in the lasso\_provider\_verify\_saml\_signature functionality of Entr'ouvert Lasso 2.5.1. (CVSS 7.5, Entr'ouvert Lasso)
- [CVE-2025-46784](https://cve.now/CVE-2025-46784.md): A denial of service vulnerability exists in the lasso\_node\_init\_from\_message\_with\_format functionality of Entr'ouvert Lasso 2.5.1. (CVSS 7.5, Entr'ouvert Lasso)
- [CVE-2025-46705](https://cve.now/CVE-2025-46705.md): A denial of service vulnerability exists in the g\_assert\_not\_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. (CVSS 7.5, Entr'ouvert Lasso)
- [CVE-2025-3125](https://cve.now/CVE-2025-3125.md): Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution (CVSS 6.7, WSO2 Identity Server · WSO2 Enterprise Integrator +6)
- [CVE-2025-52602](https://cve.now/CVE-2025-52602.md): HCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query application (CVSS 4.2, HCL Software BigFix Query)
- [CVE-2025-11745](https://cve.now/CVE-2025-11745.md): Ad Inserter \<= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (CVSS 6.4, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2025-12497](https://cve.now/CVE-2025-12497.md): Premium Portfolio Features for Phlox theme \<= 2.3.10 - Unauthenticated Local File Inclusion via args\[extra\_template\_path\] (CVSS 8.1, averta Premium Portfolio Features for Phlox theme)
- [CVE-2025-12192](https://cve.now/CVE-2025-12192.md): The Events Calendar \<= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure (CVSS 5.3, stellarwp The Events Calendar)
- [CVE-2025-12469](https://cve.now/CVE-2025-12469.md): FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce \<= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (CVSS 4.3, amans2k FunnelKit Automations – Email Marketing Automation…)
- [CVE-2025-11987](https://cve.now/CVE-2025-11987.md): Visual Link Preview \<= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode (CVSS 6.4, brechtvds Visual Link Preview)
- [CVE-2025-12468](https://cve.now/CVE-2025-12468.md): FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce \<= 3.6.4.1 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, amans2k FunnelKit Automations – Email Marketing Automation…)
- [CVE-2025-11820](https://cve.now/CVE-2025-11820.md): Graphina – Elementor Charts and Graphs \<= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets (CVSS 6.4, iqonicdesign Graphina – Charts and Graphs For Elementor)
- [CVE-2025-58337](https://cve.now/CVE-2025-58337.md): Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server (CVSS 5.4, Apache Software Foundation Apache Doris-MCP-Server · doris-…)
- [CVE-2025-55108](https://cve.now/CVE-2025-55108.md): BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution (CVSS 9.5, BMC Control-M/Agent)
- [CVE-2025-10622](https://cve.now/CVE-2025-10622.md): Foreman: os command injection via ct\_location and fcct\_location parameters (CVSS 8.0, The Foreman Foreman · Red Hat Satellite 6.15 for RHEL +4)
- [CVE-2025-12675](https://cve.now/CVE-2025-12675.md): KiotViet Sync \<= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, mykiot KiotViet Sync)
- [CVE-2025-12676](https://cve.now/CVE-2025-12676.md): KiotViet Sync \<= 1.8.5 - Use of Hard-coded Password to Authorization Bypass (CVSS 5.3, mykiot KiotViet Sync)
- [CVE-2025-12674](https://cve.now/CVE-2025-12674.md): KiotViet Sync \<= 1.8.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, mykiot KiotViet Sync)
- [CVE-2025-12677](https://cve.now/CVE-2025-12677.md): KiotViet Sync \<= 1.8.5 - Unauthenticated Webhook Key Exposure (CVSS 5.3, mykiot KiotViet Sync)
- [CVE-2025-12384](https://cve.now/CVE-2025-12384.md): Document Embedder – Embed PDFs, Word, Excel, and Other Files \<= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation (CVSS 8.6, bplugins Document Embedder – Embed PDFs, Word, Excel, and O…)
- [CVE-2025-12388](https://cve.now/CVE-2025-12388.md): B Carousel Block – Responsive Image and Content Carousel \<= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4, bplugins Carousel Block – Responsive Image and Content Caro…)
- [CVE-2025-11373](https://cve.now/CVE-2025-11373.md): Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel \<= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload (CVSS 4.3, averta Depicter — Popup & Slider Builder)
- [CVE-2025-12139](https://cve.now/CVE-2025-12139.md): File Manager for Google Drive – Integrate Google Drive with WordPress \<= 1.5.3 - Unauthenticated Sensitive Information Exposure (CVSS 7.5, princeahmed File Manager for Google Drive – Integrate Googl…)
- [CVE-2025-11917](https://cve.now/CVE-2025-11917.md): WPeMatico RSS Feed Fetcher \<= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico\_test\_feed (CVSS 6.4, etruel WPeMatico RSS Feed Fetcher)
- [CVE-2025-62225](https://cve.now/CVE-2025-62225.md): Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. (CVSS 6.7, Sony Optical Disc Archive Software)
- [CVE-2025-64151](https://cve.now/CVE-2025-64151.md): Multiple Roboticsware products provided by Roboticsware PTE. (CVSS 6.7, Roboticsware PTE. FA-Panel6 · Roboticsware PTE. BA-Panel6 +2)
- [CVE-2025-6027](https://cve.now/CVE-2025-6027.md): Ace User Management \<= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest (CVSS 6.3, Ace User Management)
- [CVE-2025-11072](https://cve.now/CVE-2025-11072.md): Download Counter Button \<= 1.8.6.7 - Unauthenticated Arbitrary File Download (CVSS 5.3, MelAbu WP Download Counter Button)
- [CVE-2025-10873](https://cve.now/CVE-2025-10873.md): Elementinvader Addons for Elementor \< 1.4.1 – Unauthenticated Arbitrary Email Sending (CVSS 5.3, ElementInvader Addons for Elementor)
- [CVE-2025-10567](https://cve.now/CVE-2025-10567.md): FunnelKit \< 3.12.0.1 - Reflected XSS (CVSS 6.3, FunnelKit)
- [CVE-2025-21079](https://cve.now/CVE-2025-21079.md): Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary (CVSS 7.1, Samsung Mobile Samsung Members)
- [CVE-2025-21078](https://cve.now/CVE-2025-21078.md): Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data fr (CVSS 8.8, Samsung Mobile Smart Switch)
- [CVE-2025-21077](https://cve.now/CVE-2025-21077.md): Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email (CVSS 3.3, Samsung Mobile Samsung Email)
- [CVE-2025-21076](https://cve.now/CVE-2025-21076.md): Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2025-21075](https://cve.now/CVE-2025-21075.md): Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21074](https://cve.now/CVE-2025-21074.md): Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21073](https://cve.now/CVE-2025-21073.md): Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user da (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2025-21071](https://cve.now/CVE-2025-21071.md): Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write ou (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2025-11749](https://cve.now/CVE-2025-11749.md): AI Engine \<= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation (CVSS 9.8, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-12197](https://cve.now/CVE-2025-12197.md): The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s (CVSS 7.5, stellarwp The Events Calendar)
- [CVE-2025-11162](https://cve.now/CVE-2025-11162.md): Spectra \<= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS (CVSS 6.4, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2025-11835](https://cve.now/CVE-2025-11835.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal (CVSS 5.3, cozmoslabs Paid Membership Subscriptions – Effortless Membe…)
- [CVE-2025-12580](https://cve.now/CVE-2025-12580.md): SMS for WordPress \<= 1.1.8 - Reflected Cross-Site Scripting (CVSS 6.1, stanleychoi SMS for WordPress)
- [CVE-2025-12582](https://cve.now/CVE-2025-12582.md): Features \<= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset (CVSS 4.3, klicher Features)
- [CVE-2025-8871](https://cve.now/CVE-2025-8871.md): Everest Forms (Pro) \<= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature (CVSS 5.6, WPEverest Everest Forms Pro)
- [CVE-2025-12735](https://cve.now/CVE-2025-12735.md): CVE-2025-12735 (CVSS 9.8, silentmatt expr-eval · expr-eval-fork +1)
- [CVE-2025-55341](https://cve.now/CVE-2025-55341.md): Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos\_nuevo.php asocImgRad. (CVSS 6.5)
- [CVE-2025-55342](https://cve.now/CVE-2025-55342.md): Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users vi (CVSS 5.3)
- [CVE-2025-55343](https://cve.now/CVE-2025-55343.md): Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt\_depe\_codi, busqueda/b (CVSS 9.9)
- [CVE-2025-56231](https://cve.now/CVE-2025-56231.md): Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass upda (CVSS 9.1)
- [CVE-2025-56232](https://cve.now/CVE-2025-56232.md): GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. (CVSS 6.8)
- [CVE-2025-57130](https://cve.now/CVE-2025-57130.md): An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker (CVSS 8.3)
- [CVE-2025-57244](https://cve.now/CVE-2025-57244.md): OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. (CVSS 5.4)
- [CVE-2025-59716](https://cve.now/CVE-2025-59716.md): ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. (CVSS 5.3)
- [CVE-2025-60753](https://cve.now/CVE-2025-60753.md): An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply\_substitution in file tar/subst.c when processing crafted (CVSS 5.5)
- [CVE-2025-60784](https://cve.now/CVE-2025-60784.md): A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst. (CVSS 6.5)
- [CVE-2025-61084](https://cve.now/CVE-2025-61084.md): MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (\<\>) in the From: header of SMTP DATA. (CVSS 7.1)
- [CVE-2025-61304](https://cve.now/CVE-2025-61304.md): OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. (CVSS 9.8)
- [CVE-2025-63248](https://cve.now/CVE-2025-63248.md): DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2025-63334](https://cve.now/CVE-2025-63334.md): PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit\_opacity.php compo (CVSS 9.8)
- [CVE-2025-63416](https://cve.now/CVE-2025-63416.md): \*\* exclusively-hosted-service \*\* A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 (CVSS 9.1)
- [CVE-2025-63417](https://cve.now/CVE-2025-63417.md): A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers t (CVSS 7.2)
- [CVE-2025-63418](https://cve.now/CVE-2025-63418.md): A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the (CVSS 6.1)
- [CVE-2025-63585](https://cve.now/CVE-2025-63585.md): OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter. (CVSS 6.5)
- [CVE-2025-63601](https://cve.now/CVE-2025-63601.md): Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious bac (CVSS 9.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.