CVEs published November 26, 2025
101 CVEs were published on November 26, 2025: 29 critical, 45 high. 1 is now in CISA KEV.
- Published
- 101
- Critical
- 29
- High
- 45
- Medium
- 21
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 41
Most affected products
- DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- 14
- OISF suricata
- 7
- GitLab
- 5
- Zenitel TCIV-3+
- 5
- digitalbazaar forge · node-forge
- 2
- favethemes Houzez
- 2
- MegaTec Taiwan ClientMate
- 2
- MegaTec Taiwan UPSilon2000V6.0
- 2
- Microsoft Azure App Gateway
- 2
- oneuptime · @oneuptime/common
- 2
Critical 29
- CVE-2025-40934XML-Sig prior to 0.68 for Perl improperly validates XML without signaturesTIMLEGGE XML::Sig
- CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attackray-project ray · ray
- CVE-2025-64130Zenitel TCIV-3+ Cross-site ScriptingZenitel TCIV-3+
- CVE-2025-64128Zenitel TCIV-3+ OS Command InjectionZenitel TCIV-3+
- CVE-2025-64127Zenitel TCIV-3+ OS Command InjectionZenitel TCIV-3+
- CVE-2025-64126Zenitel TCIV-3+ OS Command InjectionZenitel TCIV-3+
- CVE-2025-62354Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to executecursor
- CVE-2025-59390Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.Apache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2025-66022FACTION Unauthenticated Custom Extension Upload leads to RCEfactionsecurity faction
- CVE-2025-66266Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege EscalationMegaTec Taiwan UPSilon2000V6.0
- CVE-2025-66262Arbitrary File Overwrite via Tar Extraction Path TraversalDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66261Unauthenticated OS Command Injection (restore_settings.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66259Authenticated Root Remote Code Execution through improper filtering of HTTP post request parametersDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66257Unauthenticated Arbitrary File Deletion (patch_contents.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66256Unauthenticated Arbitrary File Upload (patch_contents.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66255Unauthenticated Arbitrary File Upload (upgrade_contents.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66253Unauthenticated OS Command Injection (start_upgrade.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66250Unauthenticated Arbitrary File Upload (status_contents.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-64657Azure Application Gateway Elevation of Privilege VulnerabilityMicrosoft Azure App Gateway
- CVE-2025-64656Azure Application Gateway Elevation of Privilege VulnerabilityMicrosoft Azure App Gateway
- CVE-2025-26155NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.
- CVE-2025-50399FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password.
- CVE-2025-50402FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac_password.
- CVE-2025-50433An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to tak
- CVE-2025-55469Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.
- CVE-2025-65235OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in
- CVE-2025-65236OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occ
- CVE-2025-65276An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0
- CVE-2025-65669An issue was discovered in classroomio 0.1.13.
High 45
- CVE-2025-64344Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBufferOISF suricata
- CVE-2025-64330Suricata is vulnerable to a heap buffer overflow on verdictOISF suricata
- CVE-2025-64331Suricata is vulnerable to a stack overflow on large file transfers with http-body-printableOISF suricata
- CVE-2025-64332Suricata is vulnerable to a stack overflow on larger compressed dataOISF suricata
- CVE-2025-64333Suricata is vulnerable to a stack overflow from big content-typeOISF suricata
- CVE-2025-64335Suricata is vulnerable to a null deref when used with base64_dataOISF suricata
- CVE-2025-64334Suricata is vulnerable to unbounded memory growth for decompressionOISF suricata
- CVE-2025-66031node-forge ASN.1 Unbounded Recursiondigitalbazaar forge · node-forge
- CVE-2025-66035Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsangular · @angular/common
- CVE-2019-25227Tellion HN-2204AP Unauthenticated Configuration DisclosureTellion HN-2204AP Router
- CVE-2020-36871ESCAM QD-900 Unauthenticated Configuration DisclosureESCAM QD-900 WIFI HD Camera
- CVE-2019-25226Dongyoung Media DM-AP240T/W Unauthenticated Configuration DisclosureDongyoung Media Tech Co. DM-AP240T/W Wireless Access Point
- CVE-2020-36872BACnet Test Server 1.01 Malformed BVLC Length DoSBACnet Interoperability Test Services BACnet Test Server
- CVE-2020-36873Astak CM-818T3 Unauthenticated Configuration DisclosureAstak CM-818T3 2.4GHz Wireless Security Surveillance Camera
- CVE-2020-36874ACE SECURITY WIP-90113 Unauthenticated Configuration DisclosureACE SECURITY WIP-90113 HD Camera
- CVE-2025-12571Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-65966OneUptime Unauthorized User Creation via APIoneuptime · @oneuptime/common
- CVE-2025-64129Zenitel TCIV-3+ Out-of-bounds WriteZenitel TCIV-3+
- CVE-2025-11461Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard ControllerFrappe CRM
- CVE-2025-13084Opto 22 groov View Exposure of Sensitive Information Through MetadataOpto 22 groov View Server · Opto 22 GRV-EPIC-PR1 Firmware +1
- CVE-2025-13601Glib: integer overflow in in g_escape_uri_string()glib · Red Hat Enterprise Linux +6
- CVE-2025-13735Out-of-bounds Read in nr flcASR Lapwing_Linux
- CVE-2025-12061Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL ExecutionTAX SERVICE Electronic HDM
- CVE-2025-9557Bluetooth: Mesh: Out-of-Bound Write in gen_prov_contzephyrproject-rtos Zephyr
- CVE-2025-9558Bluetooth: Mesh: Out-of-Bound Write in gen_prov_startzephyrproject-rtos Zephyr
- CVE-2025-64983Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attacker to connect via TSwitchBot Smart Video Doorbell
- CVE-2025-66021OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitizationOWASP java-html-sanitizer · com.googlecode.owasp-java-html-…
- CVE-2025-66020Valibot has a ReDoS vulnerability in `EMOJI_REGEX`open-circle valibot · valibot
- CVE-2025-12848XSS vulnerability when rendering filename in Webform MultiformDrupal
- CVE-2025-66269Unquoted Service Path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEMMegaTec Taiwan UPSilon2000V6.0
- CVE-2025-66264Unquoted Service path in UPSilon2000V6.0 SYSTEM privilege serviceMegaTec Taiwan ClientMate
- CVE-2025-66263Unauthenticated Arbitrary File Read via Null Byte InjectionDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66260PostgreSQL SQL Injection (status_sql.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66258Stored Cross-Site Scripting via XML InjectionDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66254Unauthenticated Arbitrary File Deletion (upgrade_contents.php)DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66252Infinite Loop Denial of Service via Failed File DeletionDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-66251Unauthenticated Path Traversal with Arbitrary File DeletionDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…
- CVE-2025-45311Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root.
- CVE-2025-46174Ruoyi v4.8.0 vulnerable to Incorrect Access Control.
- CVE-2025-46175Ruoyi v4.8.0 is vulnerable to Incorrect Access Control.
- CVE-2025-55471Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other u
- CVE-2025-56396An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tha
- CVE-2025-65202TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP
- CVE-2025-65278An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive i
- CVE-2025-65672Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
Medium, low and unrated 27
- CVE-2025-66040Spotipy has a XSS vulnerability in OAuth callback serverspotipy-dev spotipy · spotipy
- CVE-2025-66030node-forge ASN.1 OID Integer Truncationdigitalbazaar forge · node-forge
- CVE-2025-6195Direct Request ('Forced Browsing') in GitLabGitLab
- CVE-2025-7449Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-12653Authentication Bypass by Spoofing in GitLabGitLab
- CVE-2025-13611Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2021-4472Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' featureRed Hat OpenStack Platform · python-mistralclient
- CVE-2025-66028OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulationoneuptime · @oneuptime/common
- CVE-2025-20373Sensitive Information Disclosure in “_internal“ index through Splunk Add-On for Palo Alto NetworksSplunk Add-on for Palo Alto Networks
- CVE-2025-2486UEFI Shell accessible in AAVMF with Secure Boot enabled on UbuntuUbuntu edk2
- CVE-2025-9163Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Uploadfavethemes Houzez
- CVE-2025-9191Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Searchfavethemes Houzez
- CVE-2025-13674Access of Uninitialized Pointer in WiresharkWireshark Foundation Wireshark
- CVE-2025-62728Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIsApache Software Foundation Apache Hive · org.apache.hive… +1
- CVE-2025-66026REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]redaxo · redaxo/source
- CVE-2025-66025Caido Improperly Handles External Links in Markdowncaido
- CVE-2025-66265Insecure permissions in configuration directory (C:\\usr)MegaTec Taiwan ClientMate
- CVE-2025-55174In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the parKDE Skanpage
- CVE-2025-59820In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.KDE Krita
- CVE-2025-63938Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
- CVE-2025-65237A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary Jav
- CVE-2025-65238Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attacke
- CVE-2025-65239Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers
- CVE-2025-65670An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating
- CVE-2025-65675Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft
- CVE-2025-65676Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft
- CVE-2025-65681An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to setutor