CVEs published November 29, 2025
27 CVEs were published on November 29, 2025: 3 critical, 8 high.
- Published
- 27
- Critical
- 3
- High
- 8
- Medium
- 15
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- kiteworks security-advisories
- 5
- orangehrm
- 5
- jvde-github AIS-catcher
- 2
- OpenPrinting cups
- 2
- Anjaliavv51 Retro
- 1
- cilium · github.com/cilium/cilium
- 1
- danny-avila LibreChat
- 1
- fonttools
- 1
- lukevella rallly
- 1
- MacWarrior clipbucket-v5
- 1
Critical 3
- CVE-2025-66224OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injectionorangehrm
- CVE-2025-66216AIS-catcher has a Buffer Overflow vulnerability in `AIS::Message` leading to DoS/RCEjvde-github AIS-catcher
- CVE-2025-65112PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofingricardoboss PubNet
High 8
- CVE-2025-66289OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Changeorangehrm
- CVE-2025-66225OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workfloworangehrm
- CVE-2025-66223OpenObserve's Invite Token Lifecycle Misconfigurationopenobserve
- CVE-2025-53899Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channelkiteworks security-advisories
- CVE-2025-53896Kiteworks MFT is vulnerable to Insufficient Session Expirationkiteworks security-advisories
- CVE-2025-66217AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflowjvde-github AIS-catcher
- CVE-2025-66201LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capabilitydanny-avila LibreChat
- CVE-2025-66027Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settingslukevella rallly
Medium, low and unrated 16
- CVE-2025-6666motogadget mo.lock Ignition Lock NFC hard-coded keymotogadget mo.lock Ignition Lock
- CVE-2025-66291OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachmentsorangehrm
- CVE-2025-66290OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachmentsorangehrm
- CVE-2025-66221Werkzeug safe_join() allows Windows special device namespallets werkzeug · werkzeug
- CVE-2025-53939Kiteworks Core is vulnerable to Improper Input Validationkiteworks security-advisories
- CVE-2025-53900Kiteworks MFT has a Privilege Defined With Unsafe Actionskiteworks security-advisories
- CVE-2025-53897Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerabilitykiteworks security-advisories
- CVE-2025-58436OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attackOpenPrinting cups
- CVE-2025-61915OpenPrinting CUPS vulnerable to stack based out-of-bound writeOpenPrinting cups
- CVE-2025-66219willitmerge has a command Injection vulnerabilityshama willitmerge · willitmerge
- CVE-2025-66036Retro is vulnerable to XSS vulnerability in input handling componentAnjaliavv51 Retro
- CVE-2025-66034fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLibfonttools
- CVE-2025-65113ClipBucket v5 Unauthenticated Object Flagging VulnerabilityMacWarrior clipbucket-v5
- CVE-2025-64715Cilium with misconfigured toGroups in policies can lead to unrestricted egress trafficcilium · github.com/cilium/cilium
- CVE-2025-65540Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data.
- CVE-2025-65892Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScri