CVEs published November 13, 2025
150 CVEs were published on November 13, 2025: 6 critical, 31 high.
- Published
- 150
- Critical
- 6
- High
- 31
- Medium
- 106
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 50
Most affected products
- Cisco Digital Network Architecture Center
- 5
- Dell Alienware Command Center 6.x
- 4
- IBM AIX · IBM VIOS
- 4
- pgadmin.org pgAdmin · pgadmin4
- 4
- macrozheng mall-swarm · macrozheng mall
- 3
- 1Panel-dev MaxKB
- 2
- ays-pro Survey Maker
- 2
- baptisteArno typebot.io
- 2
- directus
- 2
- directus · @directus/api
- 2
Critical 6
- CVE-2025-36250AIX Code ExecutionIBM AIX · IBM VIOS
- CVE-2025-36096AIX Insufficiently Protected CredentialsIBM AIX · IBM VIOS
- CVE-2025-36251AIX Command ExecutionIBM AIX · IBM VIOS
- CVE-2025-64709Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook BlockbaptisteArno typebot.io
- CVE-2025-12762Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)pgadmin.org pgAdmin · pgadmin4
- CVE-2025-59367An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized acASUS DSL-AC51 · ASUS DSL-N16 +1
High 31
- CVE-2025-64530@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fieldsapollographql federation · @apollo/composition
- CVE-2025-13131Sonarr Service Sonarr.Console.exe default permissionSonarr
- CVE-2025-13130Radarr Service Radarr.Console.exe default permissionRadarr
- CVE-2025-36236AIX Path TraversalIBM AIX · IBM VIOS
- CVE-2025-47913Potential denial of service in golang.org/x/crypto/ssh/agentgolang.org/x/crypto/ssh/agent · golang.org/x/crypto
- CVE-2025-64726External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfwSocketDev firewall-release
- CVE-2025-59840Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variablevega · vega-expression +1
- CVE-2025-46369Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability.Dell Alienware Command Center 6.x
- CVE-2022-4984ZenTao Biz < 6.5, Max < 3.0, & Open Source Edition 16.5/16.5beta1 SQL Injection via user-login.htmlQingdao Esoft Tianchuang Network Technology Co. ZenTao B… +1
- CVE-2025-46367Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability.Dell Alienware Command Center
- CVE-2025-43515The issue was addressed by refusing external connections by default.Apple Compressor
- CVE-2025-20341Cisco Catalyst Center Privilege Escalation VulnerabilityCisco Digital Network Architecture Center
- CVE-2025-64511MaxKB has SSRF in sandbox1Panel-dev MaxKB
- CVE-2025-64717ZITADEL vulnerable to Account Takeover with deactivated Instance IdPzitadel · github.com/zitadel/zitadel
- CVE-2025-62484Zoom Workplace Clients - Inefficient Regular Expression ComplexityZoom Communications Zoom Workplace
- CVE-2025-64741Zoom Workplace for Android - Improper Authorization HandlingZoom Communications Zoom Workplace for Android
- CVE-2025-64740Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic SignatureZoom Communications Zoom Workplace VDI Client
- CVE-2025-12765pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.pgadmin.org pgAdmin · pgadmin4
- CVE-2025-12764pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.pgadmin.org pgAdmin · pgadmin4
- CVE-2025-12844AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserializationtigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2025-11923LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalationchrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2025-12733Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logicwpallimport WP All Import – Drag & Drop Import for CSV, XML…
- CVE-2025-60679A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.c
- CVE-2025-60690A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.1
- CVE-2025-60691A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz).
- CVE-2025-60692A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001
- CVE-2025-60694A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v
- CVE-2025-60696A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012)
- CVE-2025-60697A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries.
- CVE-2025-60698A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries.
- CVE-2025-63406An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbTo
Medium, low and unrated 113
- CVE-2025-64754Jitsi Meet has DOM Redirect on Microsoft OAuth Flowjitsi-meet
- CVE-2025-64753grist-core has insufficient access control in endpoints for comparisons between documents and versionsgristlabs grist-core
- CVE-2025-64752grist-core has path to server-side requests via websocketgristlabs grist-core
- CVE-2025-64749Directus Vulnerable to Information Leakage in Existing Collectionsdirectus · @directus/api
- CVE-2025-64748Directus's conceal fields are searchable if read permissions enableddirectus · @directus/api
- CVE-2025-64747Directus Vulnerable to Stored Cross-site Scriptingdirectus
- CVE-2025-64746Directus has Improper Permission Handling on Deleted Fieldsdirectus
- CVE-2025-64744OpenObserve Vulnerable to HTML Injection in Organization Invitation Emailsopenobserve
- CVE-2025-64745Astro development server error page vulnerable to reflected Cross-site Scriptingwithastro astro · astro
- CVE-2025-4619PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted PacketsPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-46370Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability.Dell Alienware Command Center 6.x
- CVE-2025-46362Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability.Dell Alienware Command Center 6.x
- CVE-2025-46368Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability.Dell Alienware Command Center 6.x
- CVE-2025-13123AMTT Hotel Broadband Operation System get_firstdate.php sql injectionAMTT Hotel Broadband Operation System
- CVE-2025-13122SourceCodester Patients Waiting Area Queue Management System api_patient_checkin.php getPatientAppointment sql injectionSourceCodester Patients Waiting Area Queue Management System
- CVE-2025-64706Typebot IDOR Vulnerability: Unauthorized API Token Deletion and ExposurebaptisteArno typebot.io
- CVE-2025-12785Certain HP LaserJet Pro Printers – Potential Information DisclosureHP Color LaserJet MFP M478-M479 series · HP Color LaserJ… +4
- CVE-2025-12784Certain HP LaserJet Pro Printers – Potential Information DisclosureHP Color LaserJet MFP M478-M479 series · HP Color LaserJ… +4
- CVE-2025-59480Inadequate validation of SSO redirect credentials permits credential theftMattermost
- CVE-2025-11777Cross-team channel membership accessMattermost · github.com/mattermost/mattermost-server +5
- CVE-2025-11538Keycloak-server: debug default bind addresskeycloak · Red Hat build of Keycloak +1
- CVE-2025-13121cameasy Liketea API Endpoint StoreController.php list sql injectioncameasy Liketea
- CVE-2025-20346Cisco Catalyst Center Privilege Escalation VulnerabilityCisco Digital Network Architecture Center
- CVE-2025-20355Cisco Catalyst Center Software HTTP Open Redirect VulnerabilityCisco Digital Network Architecture Center
- CVE-2025-20353Cisco Catalyst Center Cross-Site Scripting VulnerabilityCisco Digital Network Architecture Center
- CVE-2025-20349Cisco DNA Center API Command Injection VulnerabilityCisco Digital Network Architecture Center
- CVE-2025-64525Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypasswithastro astro · astro
- CVE-2025-64703MaxKB has Information Leak in sandbox1Panel-dev MaxKB
- CVE-2025-64718js-yaml has prototype pollution in merge (<<)nodeca js-yaml · js-yaml
- CVE-2025-13120mruby array.c sort_cmp use after freemruby
- CVE-2025-64714PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversalPrivateBin · privatebin/privatebin
- CVE-2025-62483Zoom Clients - Improper Removal of Sensitive InformationZoom Communications Zoom Clients
- CVE-2025-13119Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgeryFabian Ros Simple E-Banking System · SourceCodester Simple…
- CVE-2025-13118macrozheng mall-swarm paySuccess improper authorizationmacrozheng mall-swarm
- CVE-2025-62482Zoom Workplace for Windows - Cross-site ScriptingZoom Communications Zoom Workplace
- CVE-2025-30662Zoom Workplace VDI Plugin macOS Universal Installer - Symlink FollowingZoom Communications Zoom Workplace VDI Plugin macOS Univers…
- CVE-2025-30669Zoom Workplace Clients - Improper Certificate ValidationZoom Communications Zoom Workplace Clients
- CVE-2025-13117macrozheng mall-swarm/mall cancelOrder improper authorizationmacrozheng mall-swarm · macrozheng mall
- CVE-2025-64739Zoom Clients - External Control of File Name or PathZoom Communications Zoom Clients
- CVE-2025-64738Zoom Workplace for macOS - External Control of File Name or PathZoom Communications Zoom Workplace for macOS
- CVE-2025-13116macrozheng mall-swarm/mall cancelUserOrder improper authorizationmacrozheng mall-swarm · macrozheng mall
- CVE-2025-13115macrozheng mall-swarm/mall Order Details detail improper authorizationmacrozheng mall-swarm · macrozheng mall
- CVE-2025-13114macrozheng mall-swarm attr updateAttr improper authorizationmacrozheng mall-swarm
- CVE-2025-41069Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSiteT-Innova DeporSite DSuite
- CVE-2025-12818PostgreSQL libpq undersizes allocations, via integer wraparoundPostgreSQL
- CVE-2025-12817PostgreSQL CREATE STATISTICS does not check for schema CREATE privilegePostgreSQL
- CVE-2025-12763Command injection vulnerability allowing arbitrary command execution on Windowspgadmin.org pgAdmin · pgadmin4
- CVE-2025-40681Cross-Site Scripting (XSS) in xCally OmnichannelxCally Omnichannel
- CVE-2025-12377Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actionssmub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2025-64384WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerabilityjetmonsters JetFormBuilder
- CVE-2025-64383WordPress Qi Blocks plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityQode Qi Blocks
- CVE-2025-64382WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerabilityWebToffee Order Export & Order Import for WooCommerce
- CVE-2025-64381WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerabilitywpdevelop Booking Calendar
- CVE-2025-64380WordPress Booster for WooCommerce plugin <= 7.3.2 - Cross Site Scripting (XSS) vulnerabilityPluggabl Booster for WooCommerce
- CVE-2025-64379WordPress Booster for WooCommerce plugin <= 7.4.0 - Broken Access Control vulnerabilityPluggabl Booster for WooCommerce
- CVE-2025-64370WordPress YOP Poll plugin <= 6.5.38 - Broken Access Control vulnerabilityYOP Poll
- CVE-2025-64369WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerabilitycodepeople Contact Form Email
- CVE-2025-64292WordPress Analytics Germanized for Google Analytics plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerabilityPascalBajorat Analytics Germanized for Google Analytics
- CVE-2025-64277WordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerabilityQuantumCloud ChatBot
- CVE-2025-64276WordPress Survey Maker plugin <= 5.1.9.4 - Broken Access Control vulnerabilityAys Pro Survey Maker
- CVE-2025-64275WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerabilitywpdevelop Booking Manager
- CVE-2025-64274WordPress WPKoi Templates for Elementor plugin <= 3.4.4 - Broken Access Control vulnerabilitywpkoithemes WPKoi Templates for Elementor
- CVE-2025-64271WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerabilityHasThemes WP Plugin Manager
- CVE-2025-64269WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerabilityEDGARROJAS WooCommerce PDF Invoice Builder
- CVE-2025-64267WordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerabilityWPSwings WooCommerce Ultimate Points And Rewards
- CVE-2025-64265WordPress Frontend File Manager plugin <= 23.2 - Broken Access Control vulnerabilityN-Media Frontend File Manager
- CVE-2025-64264WordPress Popup addon for Ninja Forms plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityAman Popup addon for Ninja Forms
- CVE-2025-64263WordPress WP Content Pilot plugin <= 2.1.7 - Broken Access Control vulnerabilityPluginEver WP Content Pilot
- CVE-2025-64262WordPress Auto Prune Posts plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityramon fincken Auto Prune Posts
- CVE-2025-64261WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerabilitycodepeople Appointment Booking Calendar
- CVE-2025-64259WordPress Theater for WordPress plugin <= 0.18.8 - Broken Access Control vulnerabilityJeroen Schmit Theater for WordPress
- CVE-2025-7704Supermicro BMC SMASH services has a Stack-based buffer overflow vulnerabilitySMCI SYS-111C-NR
- CVE-2025-11769WordPress Content Flipper <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingaumsrini WordPress Content Flipper
- CVE-2025-11260WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypassbenmoody WP Headless CMS Framework
- CVE-2025-10295Angel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scriptingkayapati Angel – Fashion Model Agency WordPress CMS Theme
- CVE-2025-8397Save as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcoderestpack Save as PDF Button
- CVE-2025-12015Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnectsanderkah Convert WebP & AVIF | Quicq | Best image optimize…
- CVE-2025-12681Comment Edit Core – Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposureronalfy Comment Edit Core – Simple Comment Editing
- CVE-2025-12620Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameterays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- CVE-2025-12891Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposureays-pro Survey Maker
- CVE-2025-12536SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposurebrainstormforce SureForms – Contact Form, Payment Form & Ot…
- CVE-2025-12892Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Updateays-pro Survey Maker
- CVE-2025-12979Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposureuscnanbu Welcart e-Commerce
- CVE-2025-12366Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Referencesoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2025-12089Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletionsupsysticcom Data Tables Generator by Supsystic
- CVE-2025-64711PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for usersPrivateBin · privatebin/privatebin
- CVE-2025-64716Anubis vulnerable to possible XSS via redir parameter when using subrequest auth modeTecharoHQ anubis · github.com/TecharoHQ/anubis
- CVE-2025-64710Bitplatform Boilerplate has cross-site scripting vulnerabilitybitfoundation bitplatform
- CVE-2025-47220A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which
- CVE-2025-47221An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2.
- CVE-2025-47222A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2.
- CVE-2025-52186Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability
- CVE-2025-55810A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, wh
- CVE-2025-60671A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and syscon
- CVE-2025-60672An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin.
- CVE-2025-60673An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin.
- CVE-2025-60674A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling mo
- CVE-2025-60675A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and syscon
- CVE-2025-60676An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin.
- CVE-2025-60682A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, s
- CVE-2025-60683A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specificall
- CVE-2025-60684A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router f
- CVE-2025-60685A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function).
- CVE-2025-60686A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.61
- CVE-2025-60687An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi
- CVE-2025-60688A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router f
- CVE-2025-60689An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmwar
- CVE-2025-60693A stack-based buffer overflow exists in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.0
- CVE-2025-60695A stack-based buffer overflow vulnerability exists in the mtk_dut binary of Linksys E7350 routers (Firmware 1.1.00.032).
- CVE-2025-60699A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary.
- CVE-2025-60700A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binar
- CVE-2025-60701A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries.
- CVE-2025-60702A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary.