CVEs published November 10, 2025
118 CVEs were published on November 10, 2025: 6 critical, 50 high. 1 is now in CISA KEV.
- Published
- 118
- Critical
- 6
- High
- 50
- Medium
- 56
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 73
Most affected products
- Google Chrome
- 24
- Combodo iTop
- 8
- AcademySoftwareFoundation openexr · openexr
- 3
- Google Cloud Looker Studio
- 3
- JetBrains Hub
- 3
- bugsink
- 2
- e-Excellence U-Office Force
- 2
- GitHub Enterprise Server
- 2
- GNU Project GNU libbmicrohttpd
- 2
- Hundred Plus EIP Plus
- 2
Critical 6
- CVE-2021-4462Employee Records System v1.0 Arbitrary File Upload RCEEmployee Records System
- CVE-2025-64522Soft Serve is vulnerable to SSRF through its Webhookscharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2025-64513Milvus Proxy has Critical Authentication Bypass Vulnerabilitymilvus-io milvus · github.com/milvus-io/milvus
- CVE-2025-12480Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages evenTrioFox
- CVE-2025-12868CyberTutor｜New Site Server - Use of Client-Side AuthenticationCyberTutor New Site Server
- CVE-2025-12866Hundred Plus｜EIP Plus - Weak Password Recovery MechanismHundred Plus EIP Plus
High 50
- CVE-2025-11578Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationGitHub Enterprise Server
- CVE-2025-11892DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggersGitHub Enterprise Server
- CVE-2018-25124PacsOne Server 6.6.2 DICOM Web Viewer Directory Traversal LFIRainbowFish Software PacsOne Server
- CVE-2025-64519TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parametertorrentpier · torrentpier/torrentpier
- CVE-2025-64518CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injectioncyclonedx-core-java · org.cyclonedx:cyclonedx-core-java
- CVE-2025-64512pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Inputpdfminer.six · pdfminer-six
- CVE-2025-64507Incus vulnerable to local privilege escalation through custom storage volumeslxc incus · github.com/lxc/incus/v6 +1
- CVE-2025-64509Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)bugsink
- CVE-2025-64508Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli inputbugsink
- CVE-2025-64501ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute valuesetaminstudio prosemirror_to_html · prosemirror_to_html
- CVE-2025-64484OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalationoauth2-proxy · github.com/oauth2-proxy/oauth2-proxy/v7 +1
- CVE-2025-64167Combodo iTop vulnerable to reflected XSS in webservices/export.phpCombodo iTop
- CVE-2025-49145iTop admin can drop iTop database using webhooksCombodo iTop
- CVE-2025-48065Combodo iTop vulnerable to reflected XSS via objection edition form errorCombodo iTop
- CVE-2025-48055Combodo iTop has stored XSS in user portal's browse brickCombodo iTop
- CVE-2025-12727Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2025-12726Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the Google Chrome
- CVE-2025-12725Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memorGoogle Chrome
- CVE-2025-12438Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit objecGoogle Chrome
- CVE-2025-12437Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gGoogle Chrome
- CVE-2025-12432Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2025-12430Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML Google Chrome
- CVE-2025-12429Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a cGoogle Chrome
- CVE-2025-12428Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML paGoogle Chrome
- CVE-2025-47932Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboardCombodo iTop
- CVE-2025-47773Combodo iTop has XSS vulnerability in /pages/ajax.render.phpCombodo iTop
- CVE-2025-47286Combodo iTop vulnerable to Remote Code Execution in the backup creation functionalityCombodo iTop
- CVE-2025-12967An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role.AWS JDBC Wrapper · AWS Go Wrapper +4
- CVE-2025-46430Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the InstDell Display and Peripheral Manager
- CVE-2025-64456In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalationJetBrains ReSharper
- CVE-2025-64685In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosureJetBrains YouTrack
- CVE-2025-12405Unauthorized access through stored credentials in Looker StudioGoogle Cloud Looker Studio
- CVE-2025-12409SQL Injection in Looker StudioGoogle Cloud Looker Studio
- CVE-2025-12397SQL Injection in Looker StudioGoogle Cloud Looker Studio
- CVE-2025-12155Command Injection in LookerGoogle Cloud Looker
- CVE-2025-41731Jumo: Insufficient entropy in PRNG may lead to root accessJumo variTRON300 · Jumo variTRON500
- CVE-2025-12613Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values ccloudinary
- CVE-2025-62689NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier.GNU Project GNU libbmicrohttpd
- CVE-2025-59777NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier.GNU Project GNU libbmicrohttpd
- CVE-2025-12867Hundred Plus｜EIP Plus - Arbitrary File UplaodHundred Plus EIP Plus
- CVE-2025-12865e-Excellence｜U-Office Force - SQL Injectione-Excellence U-Office Force
- CVE-2025-12864e-Excellence｜U-Office Force - SQL Injectione-Excellence U-Office Force
- CVE-2025-63149Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function.
- CVE-2025-63152Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function.
- CVE-2025-63153TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function.
- CVE-2025-63154TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function.
- CVE-2025-63288In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service.
- CVE-2025-63455Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
- CVE-2025-63497The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains
- CVE-2025-63711A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an
Medium, low and unrated 62
- CVE-2025-64529SpiceDB's WriteRelationships fails silently if payload is too bigauthzed spicedb · github.com/authzed/spicedb
- CVE-2025-64504Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIslangfuse
- CVE-2025-64502Parse Server allows public `explain` queries which may expose sensitive database performance information and schema detailsparse-community parse-server · parse-server
- CVE-2025-64183OpenEXR has use after free in PyObject_StealAttrStringAcademySoftwareFoundation openexr · openexr
- CVE-2025-64182OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()AcademySoftwareFoundation openexr · openexr
- CVE-2025-64181OpenEXR Makes Use of Uninitialized MemoryAcademySoftwareFoundation openexr · openexr
- CVE-2025-62780changedetection.io vulnerable to stored XSS in Watch update via APIdgtlmoon changedetection.io · changedetection-io
- CVE-2025-48878Combodo iTop vulnerable to IDOR with ModuleInstallation objectCombodo iTop
- CVE-2025-12729Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2025-12728Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2025-12447Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engageGoogle Chrome
- CVE-2025-12446Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2025-12445Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2025-12444Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in sGoogle Chrome
- CVE-2025-12443Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a Google Chrome
- CVE-2025-12441Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a craGoogle Chrome
- CVE-2025-12440Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2025-12439Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain pGoogle Chrome
- CVE-2025-12436Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2025-12435Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2025-12434Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gGoogle Chrome
- CVE-2025-12433Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access Google Chrome
- CVE-2025-12431Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2025-33150IBM Cognos Analytics Certified Containers information disclosureIBM Cognos Analytics Certified Containers
- CVE-2025-43723Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic Dell PowerScale OneFS
- CVE-2025-43079Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud AgentsQualys Agent
- CVE-2025-64457In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race conditionJetBrains ReSharper, Rider and dotTrace
- CVE-2025-64684In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback formJetBrains YouTrack
- CVE-2025-64683In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users APIJetBrains Hub
- CVE-2025-64682In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limitJetBrains Hub
- CVE-2025-64681In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitationsJetBrains Hub
- CVE-2025-12939SourceCodester Interview Management System addCandidate.php sql injectionSourceCodester Interview Management System
- CVE-2025-12938projectworlds Online Admission System process_login.php sql injectionprojectworlds Online Admission System
- CVE-2025-41001Cross-Site Scripting (XSS) in SOPlanningSOPlanning
- CVE-2025-41107Stored XSS in Smart SchoolQDOCS Smart Schoo
- CVE-2025-12933SourceCodester Baby Care System updatewelcome.php sql injectionSourceCodester Baby Care System
- CVE-2025-12932SourceCodester Baby Care System admin.php sql injectionSourceCodester Baby Care System
- CVE-2025-12931SourceCodester Food Ordering System edit-orders.php sql injectionSourceCodester Food Ordering System
- CVE-2025-12930SourceCodester Food Ordering System view-ticket.php sql injectionSourceCodester Food Ordering System
- CVE-2025-12929SourceCodester Survey Application System LoginRegistration.php update_user sql injectionSourceCodester Survey Application System
- CVE-2025-12928code-projects Online Job Search Engine login.php sql injectioncode-projects Online Job Search Engine
- CVE-2025-12927DedeBIZ archives_add.php sql injectionDedeBIZ
- CVE-2025-12926SourceCodester Farm Management System review.php sql injectionSourceCodester Farm Management System
- CVE-2025-12925rymcu forest UserDicController.java deleteDic authorizationrymcu forest
- CVE-2025-12924rymcu forest BankController.java GlobalResult authorizationrymcu forest
- CVE-2025-12923liweiyi ChestnutCMS download resourceDownload path traversalliweiyi ChestnutCMS
- CVE-2025-12922OpenClinica Community Edition CRF Data Import ImportCRFData path traversalOpenClinica Community Edition
- CVE-2025-56503An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini
- CVE-2025-60876BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the re
- CVE-2025-63147Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function.
- CVE-2025-63296KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: durin
- CVE-2025-63384A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instru
- CVE-2025-63397Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code d
- CVE-2025-63456Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function.
- CVE-2025-63457Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function.
- CVE-2025-63617ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability.
- CVE-2025-63678An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows att
- CVE-2025-63709A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input.
- CVE-2025-63710The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF).
- CVE-2025-63712Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System.
- CVE-2025-63834A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi.
- CVE-2025-63835A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi.