CVEs published November 28, 2025
42 CVEs were published on November 28, 2025: 2 critical, 13 high.
- Published
- 42
- Critical
- 2
- High
- 13
- Medium
- 25
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Huawei HarmonyOS
- 16
- Uniong WebITR
- 4
- Huawei HarmonyOS · Huawei EMUI
- 3
- Apache Software Foundation Apache Kvrocks
- 2
- MISP
- 2
- ABB Terra AC wallbox
- 1
- cerebrate-project Cerebrate
- 1
- Devolutions Server · Devolutions Remote Desktop Manager
- 1
- Iteras Peppol-py · peppol-py
- 1
- keras-team/keras
- 1
Critical 2
High 13
- CVE-2025-12183org.lz4:lz4-java - Out-of-Bounds Memory Accessorg.lz4:lz4-java · org.lz4:lz4-pure-java +2
- CVE-2025-12638Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()keras-team/keras
- CVE-2025-13771Uniong｜WebITR - Arbitrary File ReadUniong WebITR
- CVE-2025-13770Uniong｜WebITR - SQL InjectionUniong WebITR
- CVE-2025-13769Uniong｜WebITR - SQL InjectionUniong WebITR
- CVE-2025-13768Uniong｜WebITR - Authorization BypassUniong WebITR
- CVE-2025-58308Vulnerability of improper criterion security check in the call module.Huawei HarmonyOS
- CVE-2025-58302Permission control vulnerability in the Settings module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-58310Permission control vulnerability in the distributed component.Huawei HarmonyOS
- CVE-2025-58316DoS vulnerability in the video-related system service module.Huawei HarmonyOS
- CVE-2025-58303UAF vulnerability in the screen recording framework module.Huawei HarmonyOS
- CVE-2025-51735CSV formula injection vulnerability in HCL Technologies Ltd.
- CVE-2025-66384app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.MISP
Medium, low and unrated 27
- CVE-2025-13683Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions ServeDevolutions Server · Devolutions Remote Desktop Manager
- CVE-2025-11156Improper Service Loading Vulnerability in Netskope Endpoint DLP DriverNetskope Client
- CVE-2025-59792Apache Kvrocks: MONITOR command reveals plaintext credentials to non-adminsApache Software Foundation Apache Kvrocks
- CVE-2025-59790Apache Kvrocks: RESET command grants admin privilegesApache Software Foundation Apache Kvrocks
- CVE-2025-12143Stack Memory Corruption VulnerabilityABB Terra AC wallbox
- CVE-2025-13737Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Loginnextendweb Nextend Social Login and Register
- CVE-2025-64312Permission control vulnerability in the file management module.Huawei HarmonyOS
- CVE-2025-58311UAF vulnerability in the USB driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-58305Identity authentication bypass vulnerability in the Gallery app.Huawei HarmonyOS
- CVE-2025-58304Permission control vulnerability in the file management module.Huawei HarmonyOS
- CVE-2025-58294Permission control vulnerability in the print module.Huawei HarmonyOS
- CVE-2025-64313Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-64311Permission control vulnerability in the Notepad module.Huawei HarmonyOS
- CVE-2025-58315Permission control vulnerability in the Wi-Fi module.Huawei HarmonyOS
- CVE-2025-58314Vulnerability of accessing invalid memory in the component driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-58312Permission control vulnerability in the App Lock module.Huawei HarmonyOS
- CVE-2025-58309Permission control vulnerability in the startup recovery module.Huawei HarmonyOS
- CVE-2025-58307UAF vulnerability in the screen recording framework module.Huawei HarmonyOS
- CVE-2025-64315Configuration defect vulnerability in the file management module.Huawei HarmonyOS
- CVE-2025-51733Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd.
- CVE-2025-51734Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd.
- CVE-2025-51736File upload vulnerability in HCL Technologies Ltd.
- CVE-2025-66370Kivitendo before 3.9.2 allows XXE injection.kivitendo
- CVE-2025-66371Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration.Iteras Peppol-py · peppol-py
- CVE-2025-66372Mustang before 2.16.3 allows exfiltrating files via XXE attacks.mustangproject Mustang · org.mustangproject:library +1
- CVE-2025-66382In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.libexpat project libexpat
- CVE-2025-66386app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.MISP