# CVEs published 2025-11-29

27 CVEs were published on November 29, 2025: 3 critical, 8 high. Days are UTC.

- [CVE-2025-6666](https://cve.now/CVE-2025-6666.md): motogadget mo.lock Ignition Lock NFC hard-coded key (CVSS 1.0, motogadget mo.lock Ignition Lock)
- [CVE-2025-66291](https://cve.now/CVE-2025-66291.md): OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments (CVSS 5.3, orangehrm)
- [CVE-2025-66290](https://cve.now/CVE-2025-66290.md): OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments (CVSS 5.3, orangehrm)
- [CVE-2025-66289](https://cve.now/CVE-2025-66289.md): OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change (CVSS 8.7, orangehrm)
- [CVE-2025-66225](https://cve.now/CVE-2025-66225.md): OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow (CVSS 8.7, orangehrm)
- [CVE-2025-66224](https://cve.now/CVE-2025-66224.md): OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection (CVSS 9.0, orangehrm)
- [CVE-2025-66223](https://cve.now/CVE-2025-66223.md): OpenObserve's Invite Token Lifecycle Misconfiguration (CVSS 8.4, openobserve)
- [CVE-2025-66221](https://cve.now/CVE-2025-66221.md): Werkzeug safe\_join() allows Windows special device names (CVSS 6.3, pallets werkzeug · werkzeug)
- [CVE-2025-53939](https://cve.now/CVE-2025-53939.md): Kiteworks Core is vulnerable to Improper Input Validation (CVSS 6.3, kiteworks security-advisories)
- [CVE-2025-53900](https://cve.now/CVE-2025-53900.md): Kiteworks MFT has a Privilege Defined With Unsafe Actions (CVSS 6.5, kiteworks security-advisories)
- [CVE-2025-53899](https://cve.now/CVE-2025-53899.md): Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel (CVSS 7.2, kiteworks security-advisories)
- [CVE-2025-53897](https://cve.now/CVE-2025-53897.md): Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability (CVSS 6.8, kiteworks security-advisories)
- [CVE-2025-53896](https://cve.now/CVE-2025-53896.md): Kiteworks MFT is vulnerable to Insufficient Session Expiration (CVSS 7.1, kiteworks security-advisories)
- [CVE-2025-58436](https://cve.now/CVE-2025-58436.md): OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack (CVSS 5.1, OpenPrinting cups)
- [CVE-2025-61915](https://cve.now/CVE-2025-61915.md): OpenPrinting CUPS vulnerable to stack based out-of-bound write (CVSS 6.0, OpenPrinting cups)
- [CVE-2025-66216](https://cve.now/CVE-2025-66216.md): AIS-catcher has a Buffer Overflow vulnerability in \`AIS::Message\` leading to DoS/RCE (CVSS 9.3, jvde-github AIS-catcher)
- [CVE-2025-66217](https://cve.now/CVE-2025-66217.md): AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow (CVSS 8.8, jvde-github AIS-catcher)
- [CVE-2025-66219](https://cve.now/CVE-2025-66219.md): willitmerge has a command Injection vulnerability (CVSS 6.9, shama willitmerge · willitmerge)
- [CVE-2025-66201](https://cve.now/CVE-2025-66201.md): LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability (CVSS 8.6, danny-avila LibreChat)
- [CVE-2025-66036](https://cve.now/CVE-2025-66036.md): Retro is vulnerable to XSS vulnerability in input handling component (CVSS 6.1, Anjaliavv51 Retro)
- [CVE-2025-66034](https://cve.now/CVE-2025-66034.md): fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib (CVSS 6.3, fonttools)
- [CVE-2025-66027](https://cve.now/CVE-2025-66027.md): Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings (CVSS 7.1, lukevella rallly)
- [CVE-2025-65112](https://cve.now/CVE-2025-65112.md): PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofing (CVSS 9.4, ricardoboss PubNet)
- [CVE-2025-65113](https://cve.now/CVE-2025-65113.md): ClipBucket v5 Unauthenticated Object Flagging Vulnerability (CVSS 6.5, MacWarrior clipbucket-v5)
- [CVE-2025-64715](https://cve.now/CVE-2025-64715.md): Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic (CVSS 4.0, cilium · github.com/cilium/cilium)
- [CVE-2025-65540](https://cve.now/CVE-2025-65540.md): Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. (CVSS 6.1)
- [CVE-2025-65892](https://cve.now/CVE-2025-65892.md): Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScri (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.