CVEs published November 25, 2025
119 CVEs were published on November 25, 2025: 19 critical, 35 high. 1 is now in CISA KEV.
- Published
- 119
- Critical
- 19
- High
- 35
- Medium
- 56
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 33
Most affected products
- NVIDIA DGX Spark
- 14
- ASUS Router
- 8
- MongoDB Server
- 4
- Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- 2
- bytecodealliance wasm-micro-runtime
- 2
- contao · contao/core-bundle
- 2
- geoserver · org.geoserver.web:gs-web-app +1
- 2
- Intercom Security Point (Windows) of MaLion · Intercom Secu…
- 2
- nmedia Admin and Customer Messages After Order for WooComme…
- 2
- NVIDIA NeMo Framework
- 2
Critical 19
- CVE-2025-13597AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Uploadsoportecibeles AI Feeds
- CVE-2025-13595CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Uploadsoportecibeles CIBELES AI
- CVE-2025-66016CGGMP24 is missing a check in the ZK proof used in CGGMP21LFDT-Lockness cggmp21 · cggmp24 +1
- CVE-2025-33187NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areasNVIDIA DGX Spark
- CVE-2025-59366An authentication-bypass vulnerability exists in AiCloud.ASUS Router
- CVE-2025-64693Security Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow vulnerability in processing Content-Length.Intercom Security Point (Windows) of MaLion · Intercom Secu…
- CVE-2025-62691Security Point (Windows) of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers.Intercom Security Point (Windows) of MaLion · Intercom Secu…
- CVE-2025-13559EduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalationvenusweb EduKart Pro
- CVE-2025-6389Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callbackSneeit Framework
- CVE-2025-9803Improper Authentication in lunary-ai/lunarylunary-ai/lunary
- CVE-2025-51742An issue was discovered in jishenghua JSH_ERP 2.3.1.
- CVE-2025-51743An issue was discovered in jishenghua JSH_ERP 2.3.1.
- CVE-2025-51744An issue was discovered in jishenghua JSH_ERP 2.3.1.
- CVE-2025-51745An issue was discovered in jishenghua JSH_ERP 2.3.1.
- CVE-2025-51746An issue was discovered in jishenghua JSH_ERP 2.3.1.
- CVE-2025-60739Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 20
- CVE-2025-61168An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.
- CVE-2025-63729An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certif
- CVE-2025-64063Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests.
High 35
- CVE-2025-65957Core Bot is Leaking Sensitive Credentials in Logs, Errors, and MessagesIntercore-Productions Core-Bot
- CVE-2025-65952Console is vulnerable to path traversal regarding custom assetsiiDk-the-actual Console
- CVE-2025-62703Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServerfugue-project fugue · fugue
- CVE-2025-58360GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featuregeoserver · org.geoserver.web:gs-web-app +1
- CVE-2025-66017CGGMP21 presignatures can be used in the way that significantly reduces securityLFDT-Lockness cggmp21 · cggmp21 +1
- CVE-2025-9624OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoSOpenSearch · org.opensearch:opensearch-common
- CVE-2025-65965Grype has a credential disclosure vulnerability in Grype JSON outputanchore grype · github.com/anchore/grype
- CVE-2025-12816CVE-2025-12816Digital Bazaar node-forge · Digital Bazaar forge +1
- CVE-2025-34350UnForm Server < 10.1.15 Doc Flow Unauthenticated File ReadSynergetic Data Systems UnForm Server
- CVE-2025-33203NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request ForNVIDIA NeMo Agent ToolKit
- CVE-2025-33205NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an unNVIDIA NeMo Framework
- CVE-2025-33204NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data created by an attacker NVIDIA NeMo Framework
- CVE-2025-33189NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write.NVIDIA DGX Spark
- CVE-2025-33188NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls.NVIDIA DGX Spark
- CVE-2025-65085Heap-based Buffer Overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt ShareAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-65084Out-of-bounds Write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt ShareAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-13483Missing Authentication for Critical Function in SiRcom SMART Alert (SiSA)SiRcom SMART Alert (SiSA
- CVE-2025-0248HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,HCL Software iNotes
- CVE-2025-13502Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dosThe WebKitGTK Team webkitgtk · Red Hat Enterprise Linux… +1
- CVE-2025-59371An authentication bypass vulnerability has been identified in the IFTTT integration feature.ASUS Router
- CVE-2025-59370A command injection vulnerability has been identified in bwdpi.ASUS Router
- CVE-2025-12003A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of thASUS Router
- CVE-2025-13376ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Uploadov3rkll ProjectList
- CVE-2025-12742Remote Code Execution in Looker via Teradata JDBC DriverGoogle Cloud Looker
- CVE-2025-13507Time-series operations may cause internal BSON size limit to be exceedMongoDB Server
- CVE-2025-13068Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Usernamemilmor Telegram Bot & Channel
- CVE-2025-59373A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface.MyASUS
- CVE-2025-65951Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakagemescuwa entropy-derby
- CVE-2025-64761OpenBao Privileged Operator Identity Group Root Escalationopenbao · github.com/openbao/openbao
- CVE-2025-51741An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to
- CVE-2025-64050A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administraredaxo/source
- CVE-2025-64062The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation agains
- CVE-2025-64064Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify t
- CVE-2025-64065The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation.
- CVE-2025-64066Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability.
Medium, low and unrated 65
- CVE-2025-65963CFiles Unauthorized Folder/ZIP Access in Public Spaceshumhub cfiles
- CVE-2025-66019pypdf manipulated LZWDecode streams can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2025-65956Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tagsgetformwork formwork · getformwork/formwork
- CVE-2025-65953NanoMQ UAF of retain message due to invalid MQTTV5 propertiesnanomq
- CVE-2025-65942VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOMVictoriaMetrics · github.com/VictoriaMetrics/VictoriaMetrics
- CVE-2025-64713WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcodebytecodealliance wasm-micro-runtime
- CVE-2025-64704WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instructionbytecodealliance wasm-micro-runtime
- CVE-2025-21621GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML formatgeoserver · org.geoserver.web:gs-web-app +1
- CVE-2025-65961Contao is vulnerable to cross-site scripting in templatescontao · contao/core-bundle
- CVE-2025-65960Contao is vulnerable to remote code execution in template closurescontao · contao/core-bundle
- CVE-2025-33200NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused.NVIDIA DGX Spark
- CVE-2025-33199NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior.NVIDIA DGX Spark
- CVE-2025-33198NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused.NVIDIA DGX Spark
- CVE-2025-33197NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference.NVIDIA DGX Spark
- CVE-2025-33196NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused.NVIDIA DGX Spark
- CVE-2025-33195NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause unexpected memory buffer operations.NVIDIA DGX Spark
- CVE-2025-33194NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data.NVIDIA DGX Spark
- CVE-2025-33193NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper validation of integrity.NVIDIA DGX Spark
- CVE-2025-33192NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read.NVIDIA DGX Spark
- CVE-2025-33191NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read.NVIDIA DGX Spark
- CVE-2025-33190NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write.NVIDIA DGX Spark
- CVE-2025-13467Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federationKeycloak · Red Hat build of Keycloak +1
- CVE-2025-40890Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2025-36134IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosureIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2025-59372A path traversal vulnerability has been identified in certain router models.ASUS Router
- CVE-2025-59369A SQL injection vulnerability has been identified in bwdpi.ASUS Router
- CVE-2025-59368An integer underflow vulnerability has been identified in Aicloud.ASUS Router
- CVE-2025-12587Peer Publish <= 1.0 - Cross-Site Request Forgerywebgarh Peer Publish
- CVE-2025-13385Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameterbylancer Bookme – Free Online Appointment Booking and Sched…
- CVE-2025-12634Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Updatesunarc Refund Request for WooCommerce
- CVE-2025-13370ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameterov3rkll ProjectList
- CVE-2025-13311Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Settingsigalitam Just Highlight
- CVE-2025-12645Inline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodekarthiksg Inline frame – Iframe
- CVE-2025-13405Ace Post Type Builder <= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameterbuywptemplates Ace Post Type Builder
- CVE-2025-13380AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Readliquidthemes AI Engine for WordPress: ChatGPT, GPT Content…
- CVE-2025-13382Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renamingnmedia Frontend File Manager Plugin
- CVE-2025-13404atec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposuredocjojo atec Duplicate Page & Post
- CVE-2025-12025YouTube Subscribe <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel IDmahabubs YouTube Subscribe
- CVE-2025-13386Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletionlyrathemes Social Images Widget
- CVE-2025-12525Locker Content <= 1.0.0 - Unauthenticated Information Exposureappglut Locker Content
- CVE-2025-13389Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosurenmedia Admin and Customer Messages After Order for WooComme…
- CVE-2025-12040Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulationthemehunk Wishlist for WooCommerce
- CVE-2025-12586Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgeryevolurise Conditionnal Maintenance Mode for WordPress
- CVE-2025-13452Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messagesnmedia Admin and Customer Messages After Order for WooComme…
- CVE-2025-12032ZWeb - Social Mobile <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scriptingvithanhlam Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile
- CVE-2025-13383Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storagebestweblayout Job Board by BestWebSoft
- CVE-2025-13414Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Exportgwendydd Chamber Dashboard Business Directory
- CVE-2025-12043Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings UpdateAutochat Automatic Conversation
- CVE-2025-59365A stack buffer overflow vulnerability has been identified in certain router models.ASUS Router
- CVE-2025-59485Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4.Intercom Security Point (Windows) of MaLion
- CVE-2025-13644MongoDB may be susceptible to Invariant Failure due to batched deleteMongoDB Server
- CVE-2025-13643MongoDB Server may allow queries to be terminated by unauthorized usersMongoDB Server
- CVE-2025-12893Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB ServerMongoDB Server
- CVE-2025-13558Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashingpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2025-64730Cross-site scripting vulnerability exists in SNC-CX600W all versions.Sony SNC-CX600W
- CVE-2025-62497Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0.Sony SNC-CX600W
- CVE-2025-64304"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.Fuji Television Network "FOD" App for Android · Fuji Televi…
- CVE-2025-10646Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST APIquadlayers Search Exclude
- CVE-2025-65944Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`getsentry sentry-javascript · @sentry/node +11
- CVE-2025-61167SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id
- CVE-2025-63735A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal end
- CVE-2025-64049A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbiredaxo/source
- CVE-2025-64061Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms.
- CVE-2025-64067Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) f
- CVE-2025-65647Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure v