# CVEs published 2025-11-24

100 CVEs were published on November 24, 2025: 7 critical, 36 high. Days are UTC.

- [CVE-2025-62155](https://cve.now/CVE-2025-62155.md): QuantumNous New API Has SSRF Bypass (CVSS 8.5, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2025-65018](https://cve.now/CVE-2025-65018.md): LIBPNG is vulnerable to a heap buffer overflow in \`png\_combine\_row\` triggered via \`png\_image\_finish\_read\` (CVSS 7.1, pnggroup libpng)
- [CVE-2025-64720](https://cve.now/CVE-2025-64720.md): LIBPNG is vulnerable to a buffer overflow in \`png\_image\_read\_composite\` via incorrect palette premultiplication (CVSS 7.1, pnggroup libpng)
- [CVE-2025-64506](https://cve.now/CVE-2025-64506.md): LIBPNG is vulnerable to a heap buffer over-read in \`png\_write\_image\_8bit\` with grayscale+alpha or RGB/RGBA images (CVSS 6.1, pnggroup libpng)
- [CVE-2025-64505](https://cve.now/CVE-2025-64505.md): LIBPNG is vulnerable to a heap buffer overflow in \`png\_do\_quantize\` via malformed palette index (CVSS 6.1, pnggroup libpng)
- [CVE-2025-10144](https://cve.now/CVE-2025-10144.md): Perfect Brands for WooCommerce \<= 3.6.2 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, quadlayers Perfect Brands for WooCommerce)
- [CVE-2025-29933](https://cve.now/CVE-2025-29933.md): Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of (CVSS 5.5, AMD μProf)
- [CVE-2025-48511](https://cve.now/CVE-2025-48511.md): Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in cr (CVSS 5.5, AMD μProf)
- [CVE-2025-48510](https://cve.now/CVE-2025-48510.md): Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availa (CVSS 7.1, AMD μProf)
- [CVE-2025-52538](https://cve.now/CVE-2025-52538.md): Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting (CVSS 8.0, AMD Xilinx Run Time)
- [CVE-2025-0003](https://cve.now/CVE-2025-0003.md): Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in (CVSS 7.3, AMD Xilinx Run Time)
- [CVE-2025-0007](https://cve.now/CVE-2025-0007.md): Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space (CVSS 5.7, AMD Xilinx Run Time)
- [CVE-2023-7330](https://cve.now/CVE-2023-7330.md): Ruijie Networks NBR Routers Unauthenticated Arbitrary File Upload via fileupload.php (CVSS 9.3, Beijing Star-Net Ruijie Network Technology Co. NBR Series R…)
- [CVE-2024-14007](https://cve.now/CVE-2024-14007.md): TVT NVMS-9000 \< 1.3.4 Unauthenticated Administrative Queries & Information Disclosure (CVSS 8.7, Shenzhen TVT Digital Technology Co. NVMS-9000)
- [CVE-2018-25126](https://cve.now/CVE-2018-25126.md): TVT NVMS-9000 Hard-coded API Credentials & Command Injection (CVSS 9.3, Shenzhen TVT Digital Technology Co. NVMS-9000)
- [CVE-2025-36150](https://cve.now/CVE-2025-36150.md): IBM Concert Information Disclosure (CVSS 5.9, IBM Concert)
- [CVE-2025-0005](https://cve.now/CVE-2025-0005.md): Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting (CVSS 7.3, AMD Xilinx Run Time)
- [CVE-2025-52539](https://cve.now/CVE-2025-52539.md): A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (CVSS 7.3, AMD Xilinx Run Time)
- [CVE-2025-13466](https://cve.now/CVE-2025-13466.md): body-parser vulnerable to denial of service when url encoding is used (CVSS 5.5, body-parser)
- [CVE-2025-36112](https://cve.now/CVE-2025-36112.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure (CVSS 5.3, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-13609](https://cve.now/CVE-2025-13609.md): Keylime: keylime: registrar allows identity takeover via duplicate uuid registration (CVSS 8.2, Keylime Project keylime · Red Hat Enterprise Linux +1)
- [CVE-2025-40213](https://cve.now/CVE-2025-40213.md): Bluetooth: MGMT: fix crash in set\_mesh\_sync and set\_mesh\_complete (CVSS 7.8, Linux)
- [CVE-2025-10555](https://cve.now/CVE-2025-10555.md): Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes DELMIA Service Process Engineer)
- [CVE-2025-10554](https://cve.now/CVE-2025-10554.md): Stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes ENOVIA Product Manager)
- [CVE-2025-44018](https://cve.now/CVE-2025-44018.md): A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. (CVSS 8.3, GL-Inet GL-AXT1800)
- [CVE-2025-12978](https://cve.now/CVE-2025-12978.md): CVE-2025-12978 (CVSS 5.4, FluentBit Fluent Bit)
- [CVE-2025-12969](https://cve.now/CVE-2025-12969.md): CVE-2025-12969 (CVSS 6.5, FluentBit Fluent Bit)
- [CVE-2025-12972](https://cve.now/CVE-2025-12972.md): CVE-2025-12972 (CVSS 5.3, FluentBit Fluent Bit)
- [CVE-2025-12977](https://cve.now/CVE-2025-12977.md): CVE-2025-12977 (CVSS 9.1, FluentBit Fluent Bit)
- [CVE-2025-12970](https://cve.now/CVE-2025-12970.md): CVE-2025-12970 (CVSS 8.8, FluentBit Fluent Bit)
- [CVE-2025-11921](https://cve.now/CVE-2025-11921.md): iStat Menus 7.10.4 - Local Privilege Escalation (CVSS 8.5, Bjango iStats)
- [CVE-2025-65998](https://cve.now/CVE-2025-65998.md): Apache Syncope: Default AES key used for internal password encryption (CVSS 7.5, Apache Software Foundation Apache Syncope · org.apache.sync…)
- [CVE-2025-40212](https://cve.now/CVE-2025-40212.md): nfsd: fix refcount leak in nfsd\_set\_fh\_dentry() (CVSS 9.8, Linux)
- [CVE-2025-12628](https://cve.now/CVE-2025-12628.md): WP 2FA \< 3.0.0 - Second Factor Bypass (CVSS 6.3, WP 2FA)
- [CVE-2025-41017](https://cve.now/CVE-2025-41017.md): Multiple vulnerabilities in DFUSION by Davantis (CVSS 6.9, Davantis DFUSION)
- [CVE-2025-41016](https://cve.now/CVE-2025-41016.md): Multiple vulnerabilities in DFUSION by Davantis (CVSS 8.7, Davantis DFUSION)
- [CVE-2025-12741](https://cve.now/CVE-2025-12741.md): Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution (CVSS 7.7, Google Cloud Looker)
- [CVE-2025-12740](https://cve.now/CVE-2025-12740.md): Remote Command Execution in Looker via IBM DB2 JDBC drive (CVSS 7.7, Google Cloud Looker)
- [CVE-2025-41087](https://cve.now/CVE-2025-41087.md): Cross-Site Scripting (XSS) stored in Taclia's web application (CVSS 5.1, Taclia's web application)
- [CVE-2025-41729](https://cve.now/CVE-2025-41729.md): DoS via Modbus Read Command (CVSS 7.5, Janitza UMG 96-PA · Janitza UMG 96-PA-MID+)
- [CVE-2025-12739](https://cve.now/CVE-2025-12739.md): Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise (CVSS 7.3, Google Cloud Looker)
- [CVE-2025-13596](https://cve.now/CVE-2025-13596.md): Improper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6 (CVSS 2.7, ATISoluciones CIGES)
- [CVE-2025-13588](https://cve.now/CVE-2025-13588.md): lKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery (CVSS 5.3, lKinderBueno Streamity Xtream IPTV Player)
- [CVE-2025-13586](https://cve.now/CVE-2025-13586.md): SourceCodester Online Student Clearance System changepassword.php sql injection (CVSS 5.1, SourceCodester Online Student Clearance System)
- [CVE-2025-12629](https://cve.now/CVE-2025-12629.md): Broken Link Manager \<= 0.6.5 - Reflected XSS (CVSS 7.1, Broken Link Manager)
- [CVE-2025-12569](https://cve.now/CVE-2025-12569.md): WP Front User Submit \< 5.0.0 - Open Redirect (CVSS 4.7, Guest posting / Frontend Posting / Front Editor)
- [CVE-2025-12394](https://cve.now/CVE-2025-12394.md): Backup Migration \< 2.0.0 - Unauthenticated Backup Download (CVSS 5.9, Backup Migration)
- [CVE-2024-14015](https://cve.now/CVE-2024-14015.md): Studiocart \<= 2.9.0 - Reflected XSS (CVSS 7.1, WordPress eCommerce Plugin)
- [CVE-2025-13585](https://cve.now/CVE-2025-13585.md): itsourcecode COVID Tracking System login.php sql injection (CVSS 6.9, itsourcecode COVID Tracking System)
- [CVE-2025-13584](https://cve.now/CVE-2025-13584.md): Eigenfocus Description cross site scripting (CVSS 5.1, Eigenfocus)
- [CVE-2025-7402](https://cve.now/CVE-2025-7402.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.95 - Unauthenticated SQL Injection via site\_id (CVSS 7.5, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-13583](https://cve.now/CVE-2025-13583.md): code-projects Question Paper Generator POST Parameter signupscript.php sql injection (CVSS 6.9, code-projects Question Paper Generator)
- [CVE-2025-13582](https://cve.now/CVE-2025-13582.md): code-projects Jonnys Liquor GET Parameter detail.php sql injection (CVSS 6.9, code-projects Jonnys Liquor)
- [CVE-2025-13581](https://cve.now/CVE-2025-13581.md): itsourcecode Student Information System schedule\_edit1.php sql injection (CVSS 5.3, itsourcecode Student Information System)
- [CVE-2025-13589](https://cve.now/CVE-2025-13589.md): Otsuka Information Technology｜FMS - Reflected Cross-site Scripting (CVSS 5.1, Otsuka Information Technology FMS)
- [CVE-2025-13580](https://cve.now/CVE-2025-13580.md): code-projects Library System mail.php sql injection (CVSS 5.3, code-projects Library System)
- [CVE-2025-13579](https://cve.now/CVE-2025-13579.md): code-projects Library System return.php sql injection (CVSS 5.3, code-projects Library System)
- [CVE-2025-13578](https://cve.now/CVE-2025-13578.md): code-projects Library System Login index.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-13577](https://cve.now/CVE-2025-13577.md): PHPGurukul Hostel Management System register-complaint.php cross site scripting (CVSS 5.1, PHPGurukul Hostel Management System)
- [CVE-2025-13576](https://cve.now/CVE-2025-13576.md): code-projects Blog Site admin.php improper authorization (CVSS 5.3, code-projects Blog Site)
- [CVE-2025-13575](https://cve.now/CVE-2025-13575.md): code-projects Blog Site Category blog.php category\_exists sql injection (CVSS 5.3, code-projects Blog Site)
- [CVE-2025-13574](https://cve.now/CVE-2025-13574.md): code-projects Online Bidding System addcategory.php categoryadd unrestricted upload (CVSS 5.1, code-projects Online Bidding System)
- [CVE-2024-47856](https://cve.now/CVE-2024-47856.md): In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or mor (CVSS 9.8)
- [CVE-2025-54338](https://cve.now/CVE-2025-54338.md): An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which a (CVSS 7.5)
- [CVE-2025-54341](https://cve.now/CVE-2025-54341.md): A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. (CVSS 5.3)
- [CVE-2025-54347](https://cve.now/CVE-2025-54347.md): A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows (CVSS 9.9)
- [CVE-2025-54563](https://cve.now/CVE-2025-54563.md): An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which a (CVSS 7.5)
- [CVE-2025-56400](https://cve.now/CVE-2025-56400.md): Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smar (CVSS 8.8)
- [CVE-2025-56401](https://cve.now/CVE-2025-56401.md): ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName. (CVSS 7.6)
- [CVE-2025-56423](https://cve.now/CVE-2025-56423.md): An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensit (CVSS 5.3)
- [CVE-2025-60632](https://cve.now/CVE-2025-60632.md): An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf\_ (CVSS 6.5, github.com/free5gc/pcf)
- [CVE-2025-60633](https://cve.now/CVE-2025-60633.md): An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm\_SubscriberDataManagement (CVSS 6.5, github.com/free5gc/udm · github.com/free5gc/openapi)
- [CVE-2025-60638](https://cve.now/CVE-2025-60638.md): An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf (CVSS 7.5, github.com/free5gc/nssf)
- [CVE-2025-60914](https://cve.now/CVE-2025-60914.md): Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via (CVSS 4.6)
- [CVE-2025-60915](https://cve.now/CVE-2025-60915.md): An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to exec (CVSS 8.1)
- [CVE-2025-60916](https://cve.now/CVE-2025-60916.md): A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas befor (CVSS 5.4)
- [CVE-2025-60917](https://cve.now/CVE-2025-60917.md): A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas befor (CVSS 4.6)
- [CVE-2025-63432](https://cve.now/CVE-2025-63432.md): Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. (CVSS 4.6)
- [CVE-2025-63433](https://cve.now/CVE-2025-63433.md): Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. (CVSS 4.6)
- [CVE-2025-63434](https://cve.now/CVE-2025-63434.md): The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. (CVSS 8.8)
- [CVE-2025-63435](https://cve.now/CVE-2025-63435.md): Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. (CVSS 4.3)
- [CVE-2025-63498](https://cve.now/CVE-2025-63498.md): alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. (CVSS 6.1)
- [CVE-2025-63674](https://cve.now/CVE-2025-63674.md): An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary code via overriding t (CVSS 6.1)
- [CVE-2025-63914](https://cve.now/CVE-2025-63914.md): An issue was discovered in Cinnamon kotaemon 0.11.0. (CVSS 6.5)
- [CVE-2025-63952](https://cve.now/CVE-2025-63952.md): A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily (CVSS 5.7)
- [CVE-2025-63953](https://cve.now/CVE-2025-63953.md): A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily (CVSS 6.5)
- [CVE-2025-63958](https://cve.now/CVE-2025-63958.md): MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without auth (CVSS 9.8)
- [CVE-2025-64047](https://cve.now/CVE-2025-64047.md): OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php. (CVSS 6.1)
- [CVE-2025-64048](https://cve.now/CVE-2025-64048.md): YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. (CVSS 6.1)
- [CVE-2025-65493](https://cve.now/CVE-2025-65493.md): NULL pointer dereference in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS (CVSS 7.5)
- [CVE-2025-65494](https://cve.now/CVE-2025-65494.md): NULL pointer dereference in get\_san\_or\_cn\_from\_cert() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial (CVSS 7.5)
- [CVE-2025-65495](https://cve.now/CVE-2025-65495.md): Integer signedness error in tls\_verify\_call\_back() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of (CVSS 7.5)
- [CVE-2025-65496](https://cve.now/CVE-2025-65496.md): NULL pointer dereference in coap\_dtls\_generate\_cookie() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denia (CVSS 4.3)
- [CVE-2025-65497](https://cve.now/CVE-2025-65497.md): NULL pointer dereference in coap\_dtls\_generate\_cookie() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denia (CVSS 4.3)
- [CVE-2025-65498](https://cve.now/CVE-2025-65498.md): NULL pointer dereference in coap\_dtls\_generate\_cookie() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denia (CVSS 4.3)
- [CVE-2025-65499](https://cve.now/CVE-2025-65499.md): Array index error in tls\_verify\_call\_back() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service (CVSS 4.3)
- [CVE-2025-65500](https://cve.now/CVE-2025-65500.md): NULL pointer dereference in coap\_dtls\_generate\_cookie() in src/coap\_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denia (CVSS 4.3)
- [CVE-2025-65501](https://cve.now/CVE-2025-65501.md): Null pointer dereference in coap\_dtls\_info\_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS (CVSS 4.3)
- [CVE-2025-65502](https://cve.now/CVE-2025-65502.md): Null pointer dereference in add\_ca\_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initi (CVSS 4.3)
- [CVE-2025-65503](https://cve.now/CVE-2025-65503.md): Use after free in endpoint destructors in Redboltz async\_mqtt 10.2.5 allows local users to cause a denial of service via triggering SSL init (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.