# CVEs published 2025-11-28 42 CVEs were published on November 28, 2025: 2 critical, 13 high. Days are UTC. - [CVE-2025-13683](https://cve.now/CVE-2025-13683.md): Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Serve (CVSS 6.5, Devolutions Server · Devolutions Remote Desktop Manager) - [CVE-2025-12183](https://cve.now/CVE-2025-12183.md): org.lz4:lz4-java - Out-of-Bounds Memory Access (CVSS 8.8, org.lz4:lz4-java · org.lz4:lz4-pure-java +2) - [CVE-2025-11156](https://cve.now/CVE-2025-11156.md): Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver (CVSS 5.9, Netskope Client) - [CVE-2025-59792](https://cve.now/CVE-2025-59792.md): Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins (CVSS 5.3, Apache Software Foundation Apache Kvrocks) - [CVE-2025-59790](https://cve.now/CVE-2025-59790.md): Apache Kvrocks: RESET command grants admin privileges (CVSS 5.4, Apache Software Foundation Apache Kvrocks) - [CVE-2025-12638](https://cve.now/CVE-2025-12638.md): Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get\_file() (CVSS 8.0, keras-team/keras) - [CVE-2025-12143](https://cve.now/CVE-2025-12143.md): Stack Memory Corruption Vulnerability (CVSS 6.9, ABB Terra AC wallbox) - [CVE-2025-13771](https://cve.now/CVE-2025-13771.md): Uniong｜WebITR - Arbitrary File Read (CVSS 7.1, Uniong WebITR) - [CVE-2025-13770](https://cve.now/CVE-2025-13770.md): Uniong｜WebITR - SQL Injection (CVSS 7.1, Uniong WebITR) - [CVE-2025-13769](https://cve.now/CVE-2025-13769.md): Uniong｜WebITR - SQL Injection (CVSS 7.1, Uniong WebITR) - [CVE-2025-13768](https://cve.now/CVE-2025-13768.md): Uniong｜WebITR - Authorization Bypass (CVSS 7.7, Uniong WebITR) - [CVE-2025-13737](https://cve.now/CVE-2025-13737.md): Nextend Social Login and Register \<= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login (CVSS 4.3, nextendweb Nextend Social Login and Register) - [CVE-2025-64312](https://cve.now/CVE-2025-64312.md): Permission control vulnerability in the file management module. (CVSS 4.9, Huawei HarmonyOS) - [CVE-2025-58311](https://cve.now/CVE-2025-58311.md): UAF vulnerability in the USB driver module. (CVSS 5.8, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-58308](https://cve.now/CVE-2025-58308.md): Vulnerability of improper criterion security check in the call module. (CVSS 7.3, Huawei HarmonyOS) - [CVE-2025-58305](https://cve.now/CVE-2025-58305.md): Identity authentication bypass vulnerability in the Gallery app. (CVSS 6.2, Huawei HarmonyOS) - [CVE-2025-58304](https://cve.now/CVE-2025-58304.md): Permission control vulnerability in the file management module. (CVSS 4.9, Huawei HarmonyOS) - [CVE-2025-58302](https://cve.now/CVE-2025-58302.md): Permission control vulnerability in the Settings module. (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-58294](https://cve.now/CVE-2025-58294.md): Permission control vulnerability in the print module. (CVSS 6.2, Huawei HarmonyOS) - [CVE-2025-64313](https://cve.now/CVE-2025-64313.md): Denial of service (DoS) vulnerability in the office service. (CVSS 5.3, Huawei HarmonyOS) - [CVE-2025-64311](https://cve.now/CVE-2025-64311.md): Permission control vulnerability in the Notepad module. (CVSS 5.1, Huawei HarmonyOS) - [CVE-2025-58315](https://cve.now/CVE-2025-58315.md): Permission control vulnerability in the Wi-Fi module. (CVSS 5.5, Huawei HarmonyOS) - [CVE-2025-58314](https://cve.now/CVE-2025-58314.md): Vulnerability of accessing invalid memory in the component driver module. (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-58312](https://cve.now/CVE-2025-58312.md): Permission control vulnerability in the App Lock module. (CVSS 5.1, Huawei HarmonyOS) - [CVE-2025-58310](https://cve.now/CVE-2025-58310.md): Permission control vulnerability in the distributed component. (CVSS 8.0, Huawei HarmonyOS) - [CVE-2025-58309](https://cve.now/CVE-2025-58309.md): Permission control vulnerability in the startup recovery module. (CVSS 6.8, Huawei HarmonyOS) - [CVE-2025-58307](https://cve.now/CVE-2025-58307.md): UAF vulnerability in the screen recording framework module. (CVSS 6.4, Huawei HarmonyOS) - [CVE-2025-58316](https://cve.now/CVE-2025-58316.md): DoS vulnerability in the video-related system service module. (CVSS 7.3, Huawei HarmonyOS) - [CVE-2025-58303](https://cve.now/CVE-2025-58303.md): UAF vulnerability in the screen recording framework module. (CVSS 8.4, Huawei HarmonyOS) - [CVE-2025-64315](https://cve.now/CVE-2025-64315.md): Configuration defect vulnerability in the file management module. (CVSS 4.4, Huawei HarmonyOS) - [CVE-2025-64314](https://cve.now/CVE-2025-64314.md): Permission control vulnerability in the memory management module. (CVSS 9.3, Huawei HarmonyOS) - [CVE-2025-51733](https://cve.now/CVE-2025-51733.md): Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. (CVSS 5.5) - [CVE-2025-51734](https://cve.now/CVE-2025-51734.md): Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. (CVSS 5.4) - [CVE-2025-51735](https://cve.now/CVE-2025-51735.md): CSV formula injection vulnerability in HCL Technologies Ltd. (CVSS 7.5) - [CVE-2025-51736](https://cve.now/CVE-2025-51736.md): File upload vulnerability in HCL Technologies Ltd. (CVSS 6.3) - [CVE-2025-66370](https://cve.now/CVE-2025-66370.md): Kivitendo before 3.9.2 allows XXE injection. (CVSS 5.0, kivitendo) - [CVE-2025-66371](https://cve.now/CVE-2025-66371.md): Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. (CVSS 5.0, Iteras Peppol-py · peppol-py) - [CVE-2025-66372](https://cve.now/CVE-2025-66372.md): Mustang before 2.16.3 allows exfiltrating files via XXE attacks. (CVSS 2.8, mustangproject Mustang · org.mustangproject:library +1) - [CVE-2025-66382](https://cve.now/CVE-2025-66382.md): In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. (CVSS 2.9, libexpat project libexpat) - [CVE-2025-66384](https://cve.now/CVE-2025-66384.md): app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp\_name. (CVSS 8.2, MISP) - [CVE-2025-66385](https://cve.now/CVE-2025-66385.md): UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a high (CVSS 9.4, cerebrate-project Cerebrate) - [CVE-2025-66386](https://cve.now/CVE-2025-66386.md): app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. (CVSS 4.1, MISP) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-11-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.