# CVEs published 2025-11-26

101 CVEs were published on November 26, 2025: 29 critical, 45 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-66040](https://cve.now/CVE-2025-66040.md): Spotipy has a XSS vulnerability in OAuth callback server (CVSS 3.6, spotipy-dev spotipy · spotipy)
- [CVE-2025-64344](https://cve.now/CVE-2025-64344.md): Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer (CVSS 7.5, OISF suricata)
- [CVE-2025-64330](https://cve.now/CVE-2025-64330.md): Suricata is vulnerable to a heap buffer overflow on verdict (CVSS 7.5, OISF suricata)
- [CVE-2025-64331](https://cve.now/CVE-2025-64331.md): Suricata is vulnerable to a stack overflow on large file transfers with http-body-printable (CVSS 7.5, OISF suricata)
- [CVE-2025-64332](https://cve.now/CVE-2025-64332.md): Suricata is vulnerable to a stack overflow on larger compressed data (CVSS 7.5, OISF suricata)
- [CVE-2025-64333](https://cve.now/CVE-2025-64333.md): Suricata is vulnerable to a stack overflow from big content-type (CVSS 7.5, OISF suricata)
- [CVE-2025-64335](https://cve.now/CVE-2025-64335.md): Suricata is vulnerable to a null deref when used with base64\_data (CVSS 7.5, OISF suricata)
- [CVE-2025-64334](https://cve.now/CVE-2025-64334.md): Suricata is vulnerable to unbounded memory growth for decompression (CVSS 7.5, OISF suricata)
- [CVE-2025-40934](https://cve.now/CVE-2025-40934.md): XML-Sig prior to 0.68 for Perl improperly validates XML without signatures (CVSS 9.3, TIMLEGGE XML::Sig)
- [CVE-2025-62593](https://cve.now/CVE-2025-62593.md): Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack (CVSS 9.4, KEV, ray-project ray · ray)
- [CVE-2025-66030](https://cve.now/CVE-2025-66030.md): node-forge ASN.1 OID Integer Truncation (CVSS 6.3, digitalbazaar forge · node-forge)
- [CVE-2025-66031](https://cve.now/CVE-2025-66031.md): node-forge ASN.1 Unbounded Recursion (CVSS 8.7, digitalbazaar forge · node-forge)
- [CVE-2025-66035](https://cve.now/CVE-2025-66035.md): Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs (CVSS 7.7, angular · @angular/common)
- [CVE-2019-25227](https://cve.now/CVE-2019-25227.md): Tellion HN-2204AP Unauthenticated Configuration Disclosure (CVSS 8.7, Tellion HN-2204AP Router)
- [CVE-2020-36871](https://cve.now/CVE-2020-36871.md): ESCAM QD-900 Unauthenticated Configuration Disclosure (CVSS 8.7, ESCAM QD-900 WIFI HD Camera)
- [CVE-2019-25226](https://cve.now/CVE-2019-25226.md): Dongyoung Media DM-AP240T/W Unauthenticated Configuration Disclosure (CVSS 8.7, Dongyoung Media Tech Co. DM-AP240T/W Wireless Access Point)
- [CVE-2020-36872](https://cve.now/CVE-2020-36872.md): BACnet Test Server 1.01 Malformed BVLC Length DoS (CVSS 8.7, BACnet Interoperability Test Services BACnet Test Server)
- [CVE-2020-36873](https://cve.now/CVE-2020-36873.md): Astak CM-818T3 Unauthenticated Configuration Disclosure (CVSS 8.7, Astak CM-818T3 2.4GHz Wireless Security Surveillance Camera)
- [CVE-2020-36874](https://cve.now/CVE-2020-36874.md): ACE SECURITY WIP-90113 Unauthenticated Configuration Disclosure (CVSS 8.7, ACE SECURITY WIP-90113 HD Camera)
- [CVE-2025-6195](https://cve.now/CVE-2025-6195.md): Direct Request ('Forced Browsing') in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-7449](https://cve.now/CVE-2025-7449.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-12571](https://cve.now/CVE-2025-12571.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-12653](https://cve.now/CVE-2025-12653.md): Authentication Bypass by Spoofing in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-13611](https://cve.now/CVE-2025-13611.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 2.0, GitLab)
- [CVE-2021-4472](https://cve.now/CVE-2021-4472.md): Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature (CVSS 6.5, Red Hat OpenStack Platform · python-mistralclient)
- [CVE-2025-66028](https://cve.now/CVE-2025-66028.md): OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation (CVSS 6.9, oneuptime · @oneuptime/common)
- [CVE-2025-65966](https://cve.now/CVE-2025-65966.md): OneUptime Unauthorized User Creation via API (CVSS 8.8, oneuptime · @oneuptime/common)
- [CVE-2025-20373](https://cve.now/CVE-2025-20373.md): Sensitive Information Disclosure in “\_internal“ index through Splunk Add-On for Palo Alto Networks (CVSS 2.7, Splunk Add-on for Palo Alto Networks)
- [CVE-2025-64130](https://cve.now/CVE-2025-64130.md): Zenitel TCIV-3+ Cross-site Scripting (CVSS 9.8, Zenitel TCIV-3+)
- [CVE-2025-64129](https://cve.now/CVE-2025-64129.md): Zenitel TCIV-3+ Out-of-bounds Write (CVSS 7.6, Zenitel TCIV-3+)
- [CVE-2025-64128](https://cve.now/CVE-2025-64128.md): Zenitel TCIV-3+ OS Command Injection (CVSS 10.0, Zenitel TCIV-3+)
- [CVE-2025-64127](https://cve.now/CVE-2025-64127.md): Zenitel TCIV-3+ OS Command Injection (CVSS 10.0, Zenitel TCIV-3+)
- [CVE-2025-64126](https://cve.now/CVE-2025-64126.md): Zenitel TCIV-3+ OS Command Injection (CVSS 10.0, Zenitel TCIV-3+)
- [CVE-2025-11461](https://cve.now/CVE-2025-11461.md): Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller (CVSS 7.1, Frappe CRM)
- [CVE-2025-13084](https://cve.now/CVE-2025-13084.md): Opto 22 groov View Exposure of Sensitive Information Through Metadata (CVSS 7.6, Opto 22 groov View Server · Opto 22 GRV-EPIC-PR1 Firmware +1)
- [CVE-2025-2486](https://cve.now/CVE-2025-2486.md): UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu (CVSS 3.7, Ubuntu edk2)
- [CVE-2025-62354](https://cve.now/CVE-2025-62354.md): Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute (CVSS 9.8, cursor)
- [CVE-2025-13601](https://cve.now/CVE-2025-13601.md): Glib: integer overflow in in g\_escape\_uri\_string() (CVSS 7.7, glib · Red Hat Enterprise Linux +6)
- [CVE-2025-9163](https://cve.now/CVE-2025-9163.md): Houzez \<= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 6.1, favethemes Houzez)
- [CVE-2025-9191](https://cve.now/CVE-2025-9191.md): Houzez \<= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search (CVSS 6.3, favethemes Houzez)
- [CVE-2025-13674](https://cve.now/CVE-2025-13674.md): Access of Uninitialized Pointer in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2025-59390](https://cve.now/CVE-2025-59390.md): Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. (CVSS 9.8, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2025-62728](https://cve.now/CVE-2025-62728.md): Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs (CVSS 5.4, Apache Software Foundation Apache Hive · org.apache.hive… +1)
- [CVE-2025-13735](https://cve.now/CVE-2025-13735.md): Out-of-bounds Read in nr flc (CVSS 7.4, ASR Lapwing\_Linux)
- [CVE-2025-12061](https://cve.now/CVE-2025-12061.md): Tax Service Electronic HDM \< 1.2.1 - Unauthenticated Arbitrary SQL Execution (CVSS 8.6, TAX SERVICE Electronic HDM)
- [CVE-2025-9557](https://cve.now/CVE-2025-9557.md): Bluetooth: Mesh: Out-of-Bound Write in gen\_prov\_cont (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2025-9558](https://cve.now/CVE-2025-9558.md): Bluetooth: Mesh: Out-of-Bound Write in gen\_prov\_start (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2025-64983](https://cve.now/CVE-2025-64983.md): Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attacker to connect via T (CVSS 8.0, SwitchBot Smart Video Doorbell)
- [CVE-2025-66022](https://cve.now/CVE-2025-66022.md): FACTION Unauthenticated Custom Extension Upload leads to RCE (CVSS 9.7, factionsecurity faction)
- [CVE-2025-66026](https://cve.now/CVE-2025-66026.md): REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args\[types\] (CVSS 6.1, redaxo · redaxo/source)
- [CVE-2025-66025](https://cve.now/CVE-2025-66025.md): Caido Improperly Handles External Links in Markdown (CVSS 4.3, caido)
- [CVE-2025-66021](https://cve.now/CVE-2025-66021.md): OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization (CVSS 8.6, OWASP java-html-sanitizer · com.googlecode.owasp-java-html-…)
- [CVE-2025-66020](https://cve.now/CVE-2025-66020.md): Valibot has a ReDoS vulnerability in \`EMOJI\_REGEX\` (CVSS 7.5, open-circle valibot · valibot)
- [CVE-2025-12848](https://cve.now/CVE-2025-12848.md): XSS vulnerability when rendering filename in Webform Multiform (CVSS 7.0, Drupal)
- [CVE-2025-66269](https://cve.now/CVE-2025-66269.md): Unquoted Service Path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEM (CVSS 7.1, MegaTec Taiwan UPSilon2000V6.0)
- [CVE-2025-66266](https://cve.now/CVE-2025-66266.md): Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege Escalation (CVSS 9.3, MegaTec Taiwan UPSilon2000V6.0)
- [CVE-2025-66265](https://cve.now/CVE-2025-66265.md): Insecure permissions in configuration directory (C:\\\\usr) (CVSS 6.9, MegaTec Taiwan ClientMate)
- [CVE-2025-66264](https://cve.now/CVE-2025-66264.md): Unquoted Service path in UPSilon2000V6.0 SYSTEM privilege service (CVSS 7.2, MegaTec Taiwan ClientMate)
- [CVE-2025-66263](https://cve.now/CVE-2025-66263.md): Unauthenticated Arbitrary File Read via Null Byte Injection (CVSS 8.9, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66262](https://cve.now/CVE-2025-66262.md): Arbitrary File Overwrite via Tar Extraction Path Traversal (CVSS 9.3, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66261](https://cve.now/CVE-2025-66261.md): Unauthenticated OS Command Injection (restore\_settings.php) (CVSS 9.9, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66260](https://cve.now/CVE-2025-66260.md): PostgreSQL SQL Injection (status\_sql.php) (CVSS 7.2, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66259](https://cve.now/CVE-2025-66259.md): Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters (CVSS 9.3, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66258](https://cve.now/CVE-2025-66258.md): Stored Cross-Site Scripting via XML Injection (CVSS 7.1, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66257](https://cve.now/CVE-2025-66257.md): Unauthenticated Arbitrary File Deletion (patch\_contents.php) (CVSS 9.2, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66256](https://cve.now/CVE-2025-66256.md): Unauthenticated Arbitrary File Upload (patch\_contents.php) (CVSS 9.9, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66255](https://cve.now/CVE-2025-66255.md): Unauthenticated Arbitrary File Upload (upgrade\_contents.php) (CVSS 9.9, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66254](https://cve.now/CVE-2025-66254.md): Unauthenticated Arbitrary File Deletion (upgrade\_contents.php) (CVSS 7.8, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66253](https://cve.now/CVE-2025-66253.md): Unauthenticated OS Command Injection (start\_upgrade.php) (CVSS 9.9, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66252](https://cve.now/CVE-2025-66252.md): Infinite Loop Denial of Service via Failed File Deletion (CVSS 8.4, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66251](https://cve.now/CVE-2025-66251.md): Unauthenticated Path Traversal with Arbitrary File Deletion (CVSS 7.7, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-66250](https://cve.now/CVE-2025-66250.md): Unauthenticated Arbitrary File Upload (status\_contents.php) (CVSS 9.2, DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitt…)
- [CVE-2025-64657](https://cve.now/CVE-2025-64657.md): Azure Application Gateway Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Azure App Gateway)
- [CVE-2025-64656](https://cve.now/CVE-2025-64656.md): Azure Application Gateway Elevation of Privilege Vulnerability (CVSS 9.4, Microsoft Azure App Gateway)
- [CVE-2025-26155](https://cve.now/CVE-2025-26155.md): NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability. (CVSS 9.8)
- [CVE-2025-45311](https://cve.now/CVE-2025-45311.md): Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. (CVSS 8.8)
- [CVE-2025-46174](https://cve.now/CVE-2025-46174.md): Ruoyi v4.8.0 vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2025-46175](https://cve.now/CVE-2025-46175.md): Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2025-50399](https://cve.now/CVE-2025-50399.md): FAST FAC1200R F400\_FAC1200R\_Q is vulnerable to Buffer Overflow in the function sub\_80435780 via the parameter password. (CVSS 9.8)
- [CVE-2025-50402](https://cve.now/CVE-2025-50402.md): FAST FAC1200R F400\_FAC1200R\_Q is vulnerable to Buffer Overflow in the function sub\_80435780 via the parameter string fac\_password. (CVSS 9.8)
- [CVE-2025-50433](https://cve.now/CVE-2025-50433.md): An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to tak (CVSS 9.8)
- [CVE-2025-55174](https://cve.now/CVE-2025-55174.md): In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the par (CVSS 3.2, KDE Skanpage)
- [CVE-2025-55469](https://cve.now/CVE-2025-55469.md): Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. (CVSS 9.8)
- [CVE-2025-55471](https://cve.now/CVE-2025-55471.md): Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other u (CVSS 7.5)
- [CVE-2025-56396](https://cve.now/CVE-2025-56396.md): An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tha (CVSS 8.8)
- [CVE-2025-59820](https://cve.now/CVE-2025-59820.md): In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis\_tga\_import. (CVSS 6.7, KDE Krita)
- [CVE-2025-63938](https://cve.now/CVE-2025-63938.md): Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip\_return\_port() function within src/reqs.c. (CVSS 6.5)
- [CVE-2025-65202](https://cve.now/CVE-2025-65202.md): TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP (CVSS 8.0)
- [CVE-2025-65235](https://cve.now/CVE-2025-65235.md): OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in (CVSS 9.8)
- [CVE-2025-65236](https://cve.now/CVE-2025-65236.md): OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occ (CVSS 9.8)
- [CVE-2025-65237](https://cve.now/CVE-2025-65237.md): A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary Jav (CVSS 6.1)
- [CVE-2025-65238](https://cve.now/CVE-2025-65238.md): Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attacke (CVSS 6.5)
- [CVE-2025-65239](https://cve.now/CVE-2025-65239.md): Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers (CVSS 4.3)
- [CVE-2025-65276](https://cve.now/CVE-2025-65276.md): An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 (CVSS 9.8)
- [CVE-2025-65278](https://cve.now/CVE-2025-65278.md): An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive i (CVSS 7.5)
- [CVE-2025-65669](https://cve.now/CVE-2025-65669.md): An issue was discovered in classroomio 0.1.13. (CVSS 9.1)
- [CVE-2025-65670](https://cve.now/CVE-2025-65670.md): An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating (CVSS 4.3)
- [CVE-2025-65672](https://cve.now/CVE-2025-65672.md): Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings. (CVSS 7.5)
- [CVE-2025-65675](https://cve.now/CVE-2025-65675.md): Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft (CVSS 5.4)
- [CVE-2025-65676](https://cve.now/CVE-2025-65676.md): Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft (CVSS 5.4)
- [CVE-2025-65681](https://cve.now/CVE-2025-65681.md): An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to se (CVSS 3.3, tutor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.