CVEs published November 14, 2025
101 CVEs were published on November 14, 2025: 7 critical, 28 high. 1 is now in CISA KEV.
- Published
- 101
- Critical
- 7
- High
- 28
- Medium
- 60
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 25
Most affected products
- Google Chrome
- 11
- General Industrial Controls Lynx+ Gateway
- 4
- Mattermost · github.com/mattermost/mattermost-server +3
- 4
- Brightpick AI Brightpick Mission Control / Internal Logic C…
- 3
- Palo Alto Networks Prisma Browser
- 3
- Bdtask SalesERP · CodeCanyon SalesERP
- 2
- Bdtask Wholesale Inventory Control and Inventory Management…
- 2
- code-projects Simple Online Hotel Reservation System
- 2
- IQ Service International IQ-Support
- 2
- OpenSolution QuickCMS
- 2
Critical 7
- CVE-2025-58083General Industrial Controls Lynx+ Gateway Missing Authentication for Critical FunctionGeneral Industrial Controls Lynx+ Gateway
- CVE-2021-4470TG8 Firewall Unauthenticated RCE via runphpcmd.phpTG8 Firewall
- CVE-2025-13188D-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflowD-Link DIR-816L
- CVE-2025-13204CVE-2025-13204silentmatt expr-eval · expr-eval +1
- CVE-2025-64446A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9Fortinet FortiWeb
- CVE-2025-54339An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploit
- CVE-2025-54343An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploit
High 28
- CVE-2025-9317AVEVA Edge Use of a Broken or Risky Cryptographic AlgorithmAVEVA Edge
- CVE-2025-64309Brightpick Mission Control / Internal Logic Control Unprotected Transport of CredentialsBrightpick AI Brightpick Mission Control / Internal Logic C…
- CVE-2025-62765General Industrial Controls Lynx+ Gateway Cleartext Transmission of Sensitive InformationGeneral Industrial Controls Lynx+ Gateway
- CVE-2025-59780General Industrial Controls Lynx+ Gateway Missing Authentication for Critical FunctionGeneral Industrial Controls Lynx+ Gateway
- CVE-2025-55034General Industrial Controls Lynx+ Gateway Weak Password RequirementsGeneral Industrial Controls Lynx+ Gateway
- CVE-2021-4469Denver SHO-110 IP Camera Unauthenticated Snapshot AccessDenver SHO-110
- CVE-2021-4466IPCop <= 2.1.9 Authenticated RCEIPCop Project IPCop
- CVE-2018-25125Netis DL4322D RTK 2.1.1 FTP Service DoSNetis Systems Co. DL4322D
- CVE-2021-4468PLANEX CS-QP50F-ING2 Smart Camera Remote Configuration DisclosurePLANEX COMMUNICATIONS CS-QP50F-ING2
- CVE-2021-4467Positive Technologies MaxPatrol 8 & XSpider Remote DoSPositive Technologies MaxPatrol · Positive Technologies XSp…
- CVE-2021-4465ReQuest Serious Play F3 Media Server <= 7.0.3 Remote DoSReQuest Serious Play Pro · ReQuest Serious Play
- CVE-2021-4471TG8 Firewall Unauthenticated User Password DisclosureTG8 Firewall
- CVE-2016-15056Ubee EVW3226 Unauthenticated Backup File DisclosureUbee Interactive Ubee EVW3226
- CVE-2022-4985Vodafone H500s WiFi Password Disclosure via activation.jsonVodacom Vodafone H500s
- CVE-2025-13033Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflictnodemailer · Red Hat Ceph Storage +2
- CVE-2024-21635Memos Access Tokens Stay Valid after User Password Changeusememos memos · github.com/usememos/memos
- CVE-2025-11918Rockwell Automation Arena® Simulation Stack-Based Buffer Overflow VulnerabilityRockwell Automation Arena® Simulation
- CVE-2025-88552FA Expiry Bypass in Optimus Software's Brokerage AutomationOptimus Software Brokerage Automation
- CVE-2025-10686Creta Testimonial Showcase < 1.2.4 - Editor+ Local File InclusionCreta Testimonial Showcase
- CVE-2025-64444Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier.Sony Network Communications NCP-HG100/Cellular model · Sony…
- CVE-2025-13161IQ Service International｜IQ-Support - Arbitrary File ReadIQ Service International IQ-Support
- CVE-2024-7017Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandboxGoogle Chrome
- CVE-2024-9126Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2025-12904SNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_dataotacke SNORDIAN's H5PxAPIkatchu
- CVE-2025-54345An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2.
- CVE-2025-54346A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.
- CVE-2025-63680Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExec
- CVE-2025-63891Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attac
Medium, low and unrated 66
- CVE-2025-8386AVEVA Application Server IDE Basic Cross-site ScriptingAVEVA Application Server
- CVE-2025-64308Brightpick Mission Control / Internal Logic Control Unprotected Transport of CredentialsBrightpick AI Brightpick Mission Control / Internal Logic C…
- CVE-2025-64307Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical FunctionBrightpick AI Brightpick Mission Control / Internal Logic C…
- CVE-2023-7328Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information DisclosureDB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C
- CVE-2025-13187Intelbras ICIP acessodeusuario.xml credentials storageIntelbras ICIP
- CVE-2025-13186Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scriptingBdtask Isshue Multi Store eCommerce Shopping Cart Solution…
- CVE-2025-13185Bdtask/CodeCanyon News365 profile unrestricted uploadBdtask News365 · CodeCanyon News365
- CVE-2025-13182pojoin h3blog addtitle cross site scriptingpojoin h3blog
- CVE-2025-13181pojoin h3blog add cross site scriptingpojoin h3blog
- CVE-2025-13180Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scriptingBdtask Wholesale Inventory Control and Inventory Management…
- CVE-2025-13179Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgeryBdtask Wholesale Inventory Control and Inventory Management…
- CVE-2025-13178Bdtask/CodeCanyon SalesERP User Profile edit_profile cross site scriptingBdtask SalesERP · CodeCanyon SalesERP
- CVE-2025-13177Bdtask/CodeCanyon SalesERP cross-site request forgeryBdtask SalesERP · CodeCanyon SalesERP
- CVE-2025-13174rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgeryrachelos WeRSS we-mp-rss
- CVE-2025-13172CodeAstro Gym Management System view-member-report.php sql injectionCodeAstro Gym Management System
- CVE-2025-4618Prisma Browser: Sensitive Information Disclosure Vulnerability in Prisma BrowserPalo Alto Networks Prisma Browser
- CVE-2025-4617Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma BrowserPalo Alto Networks Prisma Browser
- CVE-2025-4616Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma BrowserPalo Alto Networks Prisma Browser
- CVE-2025-13171ZZCMS wangkan_list.php sql injectionZZCMS
- CVE-2025-13170code-projects Simple Online Hotel Reservation System edit_account.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-8870On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.Arista Networks EOS
- CVE-2025-13169code-projects Simple Online Hotel Reservation System add_query_reserve.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-13168ury-erp ury pos_extend.py overrided_past_order_list sql injectionury-erp ury
- CVE-2025-12149Unauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documentsfloragunn Search Guard FLX
- CVE-2025-10018Multiple Stored XSS in QuickCMSOpenSolution QuickCMS
- CVE-2025-9982Hard-coded admin credentials in Quick.CMSOpenSolution QuickCMS
- CVE-2025-11981School Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL Injectionjdsofttech School Management System – WPSchoolPress
- CVE-2025-11794Password hash and MFA secret returned in user email verification endpointMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-55073MS Teams plugin OAuth allows editing arbitrary postsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-55070Lack of MFA enforcement in WebSocket connectionsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-41436Unauthorized access to archived channel content via threads interfaceMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-11776Guest user can discover archived public channelsMattermost · github.com/mattermost/mattermost/server/v8 +5
- CVE-2025-13160IQ Service International｜IQ-Support - Exposure of Sensitive InformationIQ Service International IQ-Support
- CVE-2025-13107Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2024-7021Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofingGoogle Chrome
- CVE-2024-13178Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crGoogle Chrome
- CVE-2025-13102Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI sGoogle Chrome
- CVE-2024-11919Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing Google Chrome
- CVE-2024-11920Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memorGoogle Chrome
- CVE-2024-13983Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2025-9479Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2025-13097Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox Google Chrome
- CVE-2024-42749Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script.
- CVE-2024-44630Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection.
- CVE-2024-44632PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php.
- CVE-2024-44633PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php.
- CVE-2024-44635PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.ph
- CVE-2024-44636PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php.
- CVE-2024-44639PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subj
- CVE-2024-44640PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.p
- CVE-2024-55016PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php.
- CVE-2025-54340A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2.
- CVE-2025-54342A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2.
- CVE-2025-54348A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2
- CVE-2025-54559An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for l
- CVE-2025-54560A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which
- CVE-2025-54561An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which a
- CVE-2025-54562A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Informatio
- CVE-2025-63291When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being reque
- CVE-2025-63701A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentProp
- CVE-2025-63724SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php.
- CVE-2025-63725Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.
- CVE-2025-63744A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c.
- CVE-2025-63745A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c.
- CVE-2025-63830CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.
- CVE-2025-64084An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier.