# CVEs published 2025-11-07

119 CVEs were published on November 7, 2025: 13 critical, 23 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-64488](https://cve.now/CVE-2025-64488.md): SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module (CVSS 8.6, SuiteCRM)
- [CVE-2025-64486](https://cve.now/CVE-2025-64486.md): calibre is vulnerable to arbitrary code execution when opening FB2 files (CVSS 9.3, kovidgoyal calibre)
- [CVE-2025-12911](https://cve.now/CVE-2025-12911.md): Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2025-12910](https://cve.now/CVE-2025-12910.md): Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive in (CVSS 6.2, Google Chrome)
- [CVE-2025-12909](https://cve.now/CVE-2025-12909.md): Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via (CVSS 5.3, Google Chrome)
- [CVE-2025-12908](https://cve.now/CVE-2025-12908.md): Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perf (CVSS 5.4, Google Chrome)
- [CVE-2025-12907](https://cve.now/CVE-2025-12907.md): Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrar (CVSS 8.8, Google Chrome)
- [CVE-2025-12906](https://cve.now/CVE-2025-12906.md): Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a c (CVSS 5.4, Google Chrome)
- [CVE-2025-12905](https://cve.now/CVE-2025-12905.md): Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the (CVSS 5.4, Google Chrome)
- [CVE-2025-64485](https://cve.now/CVE-2025-64485.md): CVAT: Mounted share file overwrite via crafted request (CVSS 5.3, cvat-ai cvat)
- [CVE-2025-64433](https://cve.now/CVE-2025-64433.md): KubeVirt Arbitrary Container File Read (CVSS 6.5, kubevirt · kubevirt.io/kubevirt)
- [CVE-2025-64437](https://cve.now/CVE-2025-64437.md): KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes (CVSS 5.0, kubevirt · kubevirt.io/kubevirt)
- [CVE-2025-64436](https://cve.now/CVE-2025-64436.md): KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes (CVSS 6.9, kubevirt · github.com/kubevirt/kubevirt +1)
- [CVE-2025-64435](https://cve.now/CVE-2025-64435.md): KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation (CVSS 5.3, kubevirt · kubevirt.io/kubevirt)
- [CVE-2025-64434](https://cve.now/CVE-2025-64434.md): KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing (CVSS 4.7, kubevirt · kubevirt.io/kubevirt)
- [CVE-2025-37736](https://cve.now/CVE-2025-37736.md): Elastic Cloud Enterprise Improper Authorization (CVSS 8.8, Elastic Cloud Enterprise)
- [CVE-2020-36870](https://cve.now/CVE-2020-36870.md): Ruijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCE (CVSS 9.2, Beijing Star-Net Ruijie Network Technology Co. RG-EG100… +35)
- [CVE-2025-12418](https://cve.now/CVE-2025-12418.md): Potential Denial of Service in Supported Versions of Revenera InstallShield (CVSS 5.6, Revenera InstallShield)
- [CVE-2025-64481](https://cve.now/CVE-2025-64481.md): Open redirect endpoint in Datasette (CVSS 2.7, simonw datasette · datasette)
- [CVE-2025-12875](https://cve.now/CVE-2025-12875.md): mruby array.c ary\_fill\_exec out-of-bounds write (CVSS 4.8, mruby)
- [CVE-2025-64442](https://cve.now/CVE-2025-64442.md): HumHub is vulnerable to XSS through its Meta Search component (CVSS 7.1, humhub)
- [CVE-2025-12896](https://cve.now/CVE-2025-12896.md): Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authori (CVSS 4.4, Solidigm™ D5-P5316, D7-P5510, D7-P5520/D7-P5620, D5-P5430,…)
- [CVE-2025-12902](https://cve.now/CVE-2025-12902.md): Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authori (CVSS 4.4, Solidigm™ D5-P5316, D5-P5430, D7-P5520/D7-P5620, D5-P5336)
- [CVE-2025-64439](https://cve.now/CVE-2025-64439.md): LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer (CVSS 7.4, langchain-ai langgraph · langgraph-checkpoint)
- [CVE-2025-10230](https://cve.now/CVE-2025-10230.md): Samba: command injection in wins server hook script (CVSS 10.0, samba · Red Hat Enterprise Linux +1)
- [CVE-2025-36006](https://cve.now/CVE-2025-36006.md): IBM Db2 denial of service (CVSS 6.5, IBM Db2)
- [CVE-2025-7700](https://cve.now/CVE-2025-7700.md): Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c) (CVSS 5.3, ffmpeg)
- [CVE-2025-36008](https://cve.now/CVE-2025-36008.md): IBM Db2 denial of service (CVSS 6.5, IBM Db2)
- [CVE-2025-36131](https://cve.now/CVE-2025-36131.md): IBM Db2 information disclosure (CVSS 4.6, IBM Db2)
- [CVE-2025-36136](https://cve.now/CVE-2025-36136.md): IBM denial of service (CVSS 5.1, IBM Db2)
- [CVE-2025-36185](https://cve.now/CVE-2025-36185.md): IBM Db2 denial of service (CVSS 6.2, IBM Db2)
- [CVE-2025-12890](https://cve.now/CVE-2025-12890.md): Bluetooth: peripheral: Invalid handling of malformed connection request (CVSS 6.5, zephyrproject-rtos Zephyr)
- [CVE-2025-36186](https://cve.now/CVE-2025-36186.md): IBM Db2 privilege escalation (CVSS 7.4, IBM Db2)
- [CVE-2025-64432](https://cve.now/CVE-2025-64432.md): KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer (CVSS 4.7, kubevirt · kubevirt.io/kubevirt)
- [CVE-2025-33012](https://cve.now/CVE-2025-33012.md): IBM Db2 improper account lockout (CVSS 6.3, IBM Db2)
- [CVE-2025-2534](https://cve.now/CVE-2025-2534.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2)
- [CVE-2025-36135](https://cve.now/CVE-2025-36135.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Cross-Site Scripting (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2024-47118](https://cve.now/CVE-2024-47118.md): IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query (CVSS 6.5, IBM Db2)
- [CVE-2025-64431](https://cve.now/CVE-2025-64431.md): IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering (CVSS 8.7, zitadel · github.com/zitadel/zitadel)
- [CVE-2025-12829](https://cve.now/CVE-2025-12829.md): An uninitialized stack read issue exists in Amazon Ion-C versions \<v1.1.4 that may allow a threat actor to craft data and serialize it to Io (CVSS 6.9, Amazon Ion-C)
- [CVE-2025-12873](https://cve.now/CVE-2025-12873.md): Campcodes School File Management update\_user.php sql injection (CVSS 5.1, Campcodes School File Management)
- [CVE-2025-9458](https://cve.now/CVE-2025-9458.md): PRT File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-64430](https://cve.now/CVE-2025-64430.md): Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2025-64347](https://cve.now/CVE-2025-64347.md): Apollo Router Improperly Enforces Renamed Access Control Directives (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2025-12862](https://cve.now/CVE-2025-12862.md): projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload (CVSS 5.3, projectworlds Online Notes Sharing Platform)
- [CVE-2025-3222](https://cve.now/CVE-2025-3222.md): Smallworld SWMFS Improper Authentication (CVSS 9.3, GE Vernova Smallworld)
- [CVE-2025-7719](https://cve.now/CVE-2025-7719.md): Smallworld SWMFS Arbitrary File Ops (CVSS 5.3, GE Vernova Smallworld)
- [CVE-2025-12861](https://cve.now/CVE-2025-12861.md): DedeBIZ spec\_add.php sql injection (CVSS 5.1, DedeBIZ)
- [CVE-2025-47207](https://cve.now/CVE-2025-47207.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-52425](https://cve.now/CVE-2025-52425.md): QuMagie (CVSS 9.5, QNAP Systems QuMagie)
- [CVE-2025-52865](https://cve.now/CVE-2025-52865.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-53408](https://cve.now/CVE-2025-53408.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-53409](https://cve.now/CVE-2025-53409.md): File Station 5 (CVSS 4.9, QNAP Systems File Station)
- [CVE-2025-53410](https://cve.now/CVE-2025-53410.md): File Station 5 (CVSS 4.9, QNAP Systems File Station)
- [CVE-2025-53411](https://cve.now/CVE-2025-53411.md): File Station 5 (CVSS 1.2, QNAP Systems File Station)
- [CVE-2025-53412](https://cve.now/CVE-2025-53412.md): File Station 5 (CVSS 0.6, QNAP Systems File Station)
- [CVE-2025-53413](https://cve.now/CVE-2025-53413.md): File Station 5 (CVSS 4.9, QNAP Systems File Station)
- [CVE-2025-54167](https://cve.now/CVE-2025-54167.md): Notification Center (CVSS 7.2, QNAP Systems Notification Center)
- [CVE-2025-54168](https://cve.now/CVE-2025-54168.md): QuLog Center (CVSS 2.2, QNAP Systems QuLog Center)
- [CVE-2025-57706](https://cve.now/CVE-2025-57706.md): File Station 5 (CVSS 2.2, QNAP Systems File Station)
- [CVE-2025-57712](https://cve.now/CVE-2025-57712.md): Qsync Central (CVSS 4.0, QNAP Systems Qsync Central)
- [CVE-2025-58463](https://cve.now/CVE-2025-58463.md): Download Station (CVSS 2.3, QNAP Systems Download Station)
- [CVE-2025-58464](https://cve.now/CVE-2025-58464.md): QuMagie (CVSS 7.8, QNAP Systems QuMagie)
- [CVE-2025-58465](https://cve.now/CVE-2025-58465.md): Download Station (CVSS 2.2, QNAP Systems Download Station)
- [CVE-2025-58469](https://cve.now/CVE-2025-58469.md): QuLog Center (CVSS 1.2, QNAP Systems QuLog Center)
- [CVE-2025-12860](https://cve.now/CVE-2025-12860.md): DedeBIZ freelist\_main.php sql injection (CVSS 5.1, DedeBIZ)
- [CVE-2025-12859](https://cve.now/CVE-2025-12859.md): DedeBIZ templets\_one\_edit.php sql injection (CVSS 5.1, DedeBIZ)
- [CVE-2025-12857](https://cve.now/CVE-2025-12857.md): code-projects Responsive Hotel Site roombook.php sql injection (CVSS 5.1, code-projects Responsive Hotel Site)
- [CVE-2025-34299](https://cve.now/CVE-2025-34299.md): Monsta FTP \<= 2.11 Unauthenticated Arbitrary File Upload (CVSS 9.3, Monsta Limited of New Zealand Monsta FTP)
- [CVE-2025-12856](https://cve.now/CVE-2025-12856.md): code-projects Responsive Hotel Site reservation.php sql injection (CVSS 5.1, code-projects Responsive Hotel Site)
- [CVE-2025-12855](https://cve.now/CVE-2025-12855.md): code-projects Responsive Hotel Site newsletterdel.php sql injection (CVSS 5.1, code-projects Responsive Hotel Site)
- [CVE-2025-10968](https://cve.now/CVE-2025-10968.md): SQLi in GG Soft's PaperWork (CVSS 8.8, GG Soft Software Services PaperWork)
- [CVE-2025-12854](https://cve.now/CVE-2025-12854.md): newbee-mall-plus seckillExecution executeSeckill authorization (CVSS 6.3, newbee-mall-plus)
- [CVE-2025-12853](https://cve.now/CVE-2025-12853.md): SourceCodester Best House Rental Management System admin\_class.php delete\_house sql injection (CVSS 5.1, SourceCodester Best House Rental Management System)
- [CVE-2025-10870](https://cve.now/CVE-2025-10870.md): SQL injection in DIAL's CentrosNet (CVSS 9.3, DIAL CentrosNet)
- [CVE-2025-46413](https://cve.now/CVE-2025-46413.md): Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. (CVSS 4.3, BUFFALO WSR-1800AX4 · BUFFALO WSR-1800AX4S +2)
- [CVE-2025-10966](https://cve.now/CVE-2025-10966.md): missing SFTP host verification with wolfSSH (CVSS 4.3, curl)
- [CVE-2025-64346](https://cve.now/CVE-2025-64346.md): archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 6.0, jaredallard archives · github.com/jaredallard/archives)
- [CVE-2025-12527](https://cve.now/CVE-2025-12527.md): Page & Post Notes \<= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion (CVSS 4.3, yydevelopment Page & Post Notes)
- [CVE-2025-12520](https://cve.now/CVE-2025-12520.md): WP Airbnb Review Slider \<= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.0, jgwhite33 WP Airbnb Review Slider)
- [CVE-2025-64343](https://cve.now/CVE-2025-64343.md): (conda) Constructor: Excessive permissions during and after installation (CVSS 7.8, conda constructor)
- [CVE-2025-64339](https://cve.now/CVE-2025-64339.md): ClipBucket v5: Stored XSS Vulnerability in Manage Playlists (CVSS 7.2, MacWarrior clipbucket-v5)
- [CVE-2025-64336](https://cve.now/CVE-2025-64336.md): ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title (CVSS 7.2, MacWarrior clipbucket-v5)
- [CVE-2025-4522](https://cve.now/CVE-2025-4522.md): IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin\_post\_donor\_delete Function (CVSS 6.5, themeatelier IDonate – Blood Donation, Request And Donor Ma…)
- [CVE-2025-4519](https://cve.now/CVE-2025-4519.md): IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate\_donor\_password Function (CVSS 8.8, themeatelier IDonate – Blood Donation, Request And Donor Ma…)
- [CVE-2025-12352](https://cve.now/CVE-2025-12352.md): Gravity Forms \<= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy\_post\_image' (CVSS 9.8, Gravity Forms)
- [CVE-2025-64329](https://cve.now/CVE-2025-64329.md): containerd CRI server: Host memory exhaustion through Attach goroutine leak (CVSS 6.9, containerd · github.com/containerd/containerd +1)
- [CVE-2025-64328](https://cve.now/CVE-2025-64328.md): FreePBX Administration GUI is Vulnerable to Authenticated Command Injection (CVSS 8.6, KEV, FreePBX filestore)
- [CVE-2025-5483](https://cve.now/CVE-2025-5483.md): LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation (CVSS 8.1, niaj Connector Wizard)
- [CVE-2025-64323](https://cve.now/CVE-2025-64323.md): kgateway is missing xDS authorization (CVSS 5.3, kgateway-dev kgateway · github.com/kgateway-dev/kgateway +1)
- [CVE-2025-64187](https://cve.now/CVE-2025-64187.md): OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts (CVSS 4.6, OctoPrint)
- [CVE-2025-64184](https://cve.now/CVE-2025-64184.md): Dosage vulnerable to Directory Traversal through crafted HTTP responses (CVSS 8.8, webcomics dosage · dosage)
- [CVE-2025-64180](https://cve.now/CVE-2025-64180.md): Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU) (CVSS 10.0, Manager-io Manager)
- [CVE-2025-11546](https://cve.now/CVE-2025-11546.md): CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleSe (CVSS 9.3, NEC CLUSTERPRO X for Linux · NEC CLUSTERPRO X SingleServerS…)
- [CVE-2025-48985](https://cve.now/CVE-2025-48985.md): A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. (CVSS 3.7, Vercel AI SDK · ai)
- [CVE-2025-52662](https://cve.now/CVE-2025-52662.md): A vulnerability in Nuxt DevTools has been fixed in version \*\*2.6.4\*\*\*. (CVSS 6.9, Vercel Nuxt Devtools · @nuxt/devtools)
- [CVE-2025-57697](https://cve.now/CVE-2025-57697.md): AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function \_encode\_image\_bs64. (CVSS 6.5, astrbot)
- [CVE-2025-57698](https://cve.now/CVE-2025-57698.md): AstrBot Project v3.5.22 contains a directory traversal vulnerability. (CVSS 7.5, astrbot)
- [CVE-2025-60574](https://cve.now/CVE-2025-60574.md): A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. (CVSS 7.5)
- [CVE-2025-61261](https://cve.now/CVE-2025-61261.md): A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the (CVSS 5.4)
- [CVE-2025-63420](https://cve.now/CVE-2025-63420.md): CrushFTP11 before 11.3.7\_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling pe (CVSS 4.1)
- [CVE-2025-63543](https://cve.now/CVE-2025-63543.md): TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search\_results endpoint via the q parameter. (CVSS 6.1)
- [CVE-2025-63544](https://cve.now/CVE-2025-63544.md): TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order\_notes via the id parameter. (CVSS 6.1)
- [CVE-2025-63638](https://cve.now/CVE-2025-63638.md): Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" f (CVSS 6.1)
- [CVE-2025-63639](https://cve.now/CVE-2025-63639.md): The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to imprope (CVSS 6.1)
- [CVE-2025-63640](https://cve.now/CVE-2025-63640.md): Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields w (CVSS 6.1)
- [CVE-2025-63686](https://cve.now/CVE-2025-63686.md): There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23 (CVSS 6.5)
- [CVE-2025-63687](https://cve.now/CVE-2025-63687.md): An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/se (CVSS 6.5)
- [CVE-2025-63689](https://cve.now/CVE-2025-63689.md): Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allo (CVSS 10.0)
- [CVE-2025-63690](https://cve.now/CVE-2025-63690.md): In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management modu (CVSS 9.1)
- [CVE-2025-63691](https://cve.now/CVE-2025-63691.md): In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interfa (CVSS 9.6)
- [CVE-2025-63713](https://cve.now/CVE-2025-63713.md): Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML (CVSS 6.1)
- [CVE-2025-63714](https://cve.now/CVE-2025-63714.md): Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScrip (CVSS 6.1)
- [CVE-2025-63716](https://cve.now/CVE-2025-63716.md): The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing (CVSS 6.5)
- [CVE-2025-63717](https://cve.now/CVE-2025-63717.md): The change password functionality at /pet\_grooming/admin/change\_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerabl (CVSS 6.5)
- [CVE-2025-63718](https://cve.now/CVE-2025-63718.md): A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api\_patient\_schedule.php endpoi (CVSS 6.5)
- [CVE-2025-63783](https://cve.now/CVE-2025-63783.md): A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) o (CVSS 7.6)
- [CVE-2025-63784](https://cve.now/CVE-2025-63784.md): An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook (CVSS 6.5)
- [CVE-2025-63785](https://cve.now/CVE-2025-63785.md): A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.