# CVEs published 2025-12-01

143 CVEs were published on December 1, 2025: 10 critical, 61 high. Days are UTC.

- [CVE-2025-66448](https://cve.now/CVE-2025-66448.md): vLLM vulnerable to remote code execution via transformers\_utils/get\_config (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2025-66401](https://cve.now/CVE-2025-66401.md): MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL (CVSS 9.8, kapilduraphe mcp-watch · mcp-watch)
- [CVE-2025-66415](https://cve.now/CVE-2025-66415.md): fastify-reply-from bypass of reply forwarding (CVSS 6.9, fastify-reply-from · @fastify/reply-from)
- [CVE-2025-66412](https://cve.now/CVE-2025-66412.md): Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes (CVSS 8.5, angular · @angular/compiler)
- [CVE-2025-66410](https://cve.now/CVE-2025-66410.md): Gin-vue-admin has an arbitrary file deletion vulnerability (CVSS 8.7, flipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…)
- [CVE-2025-66405](https://cve.now/CVE-2025-66405.md): Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host (CVSS 6.9, Portkey-AI gateway · @portkey-ai/gateway)
- [CVE-2025-66403](https://cve.now/CVE-2025-66403.md): FileRise Vulnerable to Stored XSS via SVG Upload (CVSS 4.6, error311 FileRise)
- [CVE-2025-66400](https://cve.now/CVE-2025-66400.md): mdast-util-to-hast unsanitized class attribute (CVSS 6.9, syntax-tree mdast-util-to-hast · mdast-util-to-hast)
- [CVE-2025-66313](https://cve.now/CVE-2025-66313.md): ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter (CVSS 5.1, ChurchCRM CRM)
- [CVE-2025-66312](https://cve.now/CVE-2025-66312.md): Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/accounts/groups/\[group\]\` parameter \`data\[readableName\]\` (CVSS 6.2, getgrav grav · getgrav/grav)
- [CVE-2025-66311](https://cve.now/CVE-2025-66311.md): Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` in Multiples parameters (CVSS 6.2, getgrav grav · getgrav/grav)
- [CVE-2025-66310](https://cve.now/CVE-2025-66310.md): Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` parameter \`data\[header\]\[template\]\` in Advanced Tab (CVSS 6.2, getgrav grav · getgrav/grav)
- [CVE-2025-66309](https://cve.now/CVE-2025-66309.md): Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/\[page\], parameter data\[header\]\[content\]\[items\], located in the "Blog Config" tab (CVSS 6.2, getgrav grav · getgrav/grav)
- [CVE-2025-66308](https://cve.now/CVE-2025-66308.md): Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/config/site\` parameter \`data\[taxonomies\]\` (CVSS 6.8, getgrav grav · getgrav/grav)
- [CVE-2025-66307](https://cve.now/CVE-2025-66307.md): Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure (CVSS 6.5, getgrav grav · getgrav/grav)
- [CVE-2025-66306](https://cve.now/CVE-2025-66306.md): Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel (CVSS 4.3, getgrav grav · getgrav/grav)
- [CVE-2025-66305](https://cve.now/CVE-2025-66305.md): Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter (CVSS 6.9, getgrav grav · getgrav/grav)
- [CVE-2025-66304](https://cve.now/CVE-2025-66304.md): Grav Exposes Password Hashes Leading to privilege escalation (CVSS 6.2, getgrav grav · getgrav/grav)
- [CVE-2025-66303](https://cve.now/CVE-2025-66303.md): Grav is vulnerable to a DOS on the admin panel (CVSS 4.9, getgrav grav · getgrav/grav)
- [CVE-2025-66302](https://cve.now/CVE-2025-66302.md): Grav vulnerable to Path Traversal allowing server files backup (CVSS 6.8, getgrav grav · getgrav/grav)
- [CVE-2025-66301](https://cve.now/CVE-2025-66301.md): Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions (CVSS 8.6, getgrav grav · getgrav/grav)
- [CVE-2025-66300](https://cve.now/CVE-2025-66300.md): Grav is vulnerable to Arbitrary File Read (CVSS 8.5, getgrav grav · getgrav/grav)
- [CVE-2025-66299](https://cve.now/CVE-2025-66299.md): Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2025-66298](https://cve.now/CVE-2025-66298.md): Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms (CVSS 7.7, getgrav grav · getgrav/grav)
- [CVE-2025-66297](https://cve.now/CVE-2025-66297.md): Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection (CVSS 7.4, getgrav grav · getgrav/grav)
- [CVE-2025-66296](https://cve.now/CVE-2025-66296.md): Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2025-66294](https://cve.now/CVE-2025-66294.md): Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass (CVSS 8.7, getgrav grav · getgrav/grav)
- [CVE-2025-66295](https://cve.now/CVE-2025-66295.md): Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2025-66206](https://cve.now/CVE-2025-66206.md): Frappe vulnerable to a path traversal allowing reading certain files (CVSS 6.8, frappe)
- [CVE-2025-66205](https://cve.now/CVE-2025-66205.md): Frappe has the possibility of SQL Injection due to improper validations (CVSS 7.1, frappe)
- [CVE-2025-58044](https://cve.now/CVE-2025-58044.md): JumpServer has an Open Redirect Vulnerability (CVSS 5.5, jumpserver)
- [CVE-2025-55749](https://cve.now/CVE-2025-55749.md): The XWiki Jetty package (XJetty) allows accessing any application file through URL (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-tool-jet…)
- [CVE-2025-12756](https://cve.now/CVE-2025-12756.md): Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2025-11772](https://cve.now/CVE-2025-11772.md): Co-Installer Privilege Escalation (CVSS 6.6, Synaptics Fingerprint Driver)
- [CVE-2025-34297](https://cve.now/CVE-2025-34297.md): KissFFT Integer Overflow Heap Buffer Overflow via kiss\_fft\_alloc (CVSS 8.6, mborgerding/kissfft)
- [CVE-2025-13837](https://cve.now/CVE-2025-13837.md): Out-of-memory when loading Plist (CVSS 2.1, Python Software Foundation CPython)
- [CVE-2025-13836](https://cve.now/CVE-2025-13836.md): Excessive read buffering DoS in http.client (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2025-13653](https://cve.now/CVE-2025-13653.md): Unauthorized access to documents in data streams with specially crafted requests (CVSS 4.3, floragunn Search Guard FLX)
- [CVE-2025-13835](https://cve.now/CVE-2025-13835.md): WordPress Arconix Shortcodes plugin \<= 2.1.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tychesoftwares Arconix Shortcodes)
- [CVE-2025-7007](https://cve.now/CVE-2025-7007.md): Null pointer dereference in Avast Antivirus on macOS (16.0.0) or Linux (3.0.3) (CVSS 7.5, Avast Antivirus · Avast Anitvirus)
- [CVE-2025-3500](https://cve.now/CVE-2025-3500.md): Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation (CVSS 9.0, Avast Antivirus)
- [CVE-2025-64775](https://cve.now/CVE-2025-64775.md): Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) (CVSS 7.5, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2025-8351](https://cve.now/CVE-2025-8351.md): Avira antivirus engine heap buffer OOB read when scanning a malformed file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-13829](https://cve.now/CVE-2025-13829.md): Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any (CVSS 8.6, Data Illusion Zumbrunn NGSurvey)
- [CVE-2025-10101](https://cve.now/CVE-2025-10101.md): Avast antivirus heap buffer OOB read when scanning a malformed Mach-O file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2024-48894](https://cve.now/CVE-2024-48894.md): A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 5.9, Socomec DIRIS Digiware M-70)
- [CVE-2024-53684](https://cve.now/CVE-2024-53684.md): A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.5, Socomec DIRIS Digiware M-70)
- [CVE-2024-45370](https://cve.now/CVE-2024-45370.md): An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. (CVSS 7.3, Socomec Easy Config System)
- [CVE-2024-49572](https://cve.now/CVE-2024-49572.md): A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.2, Socomec DIRIS Digiware M-70)
- [CVE-2024-48882](https://cve.now/CVE-2024-48882.md): A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 8.6, Socomec DIRIS Digiware M-70)
- [CVE-2025-20085](https://cve.now/CVE-2025-20085.md): A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.2, Socomec DIRIS Digiware M-70)
- [CVE-2025-23417](https://cve.now/CVE-2025-23417.md): A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 8.6, Socomec DIRIS Digiware M-70)
- [CVE-2025-26858](https://cve.now/CVE-2025-26858.md): A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 8.6, Socomec DIRIS Digiware M-70)
- [CVE-2025-54851](https://cve.now/CVE-2025-54851.md): A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.5, Socomec DIRIS Digiware M-70)
- [CVE-2025-54850](https://cve.now/CVE-2025-54850.md): A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.5, Socomec DIRIS Digiware M-70)
- [CVE-2025-54849](https://cve.now/CVE-2025-54849.md): A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.5, Socomec DIRIS Digiware M-70)
- [CVE-2025-54848](https://cve.now/CVE-2025-54848.md): A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. (CVSS 7.5, Socomec DIRIS Digiware M-70)
- [CVE-2025-55222](https://cve.now/CVE-2025-55222.md): A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 (CVSS 8.6, Socomec DIRIS Digiware M-70)
- [CVE-2025-55221](https://cve.now/CVE-2025-55221.md): A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 (CVSS 8.6, Socomec DIRIS Digiware M-70)
- [CVE-2025-11699](https://cve.now/CVE-2025-11699.md): CVE-2025-11699 (CVSS 7.1, nopSolutions nopCommerce)
- [CVE-2025-13129](https://cve.now/CVE-2025-13129.md): Business Logic Error in Seneka Software's Onaylarım (CVSS 4.3, Seneka Software Hardware Information Technology Trade Contr…)
- [CVE-2025-49643](https://cve.now/CVE-2025-49643.md): Frontend DoS vulnerability due to asymmetric resource consumption (CVSS 6.0, Zabbix)
- [CVE-2025-49642](https://cve.now/CVE-2025-49642.md): Agent builds for AIX vulnerable to library loading hijacking (CVSS 5.8, Zabbix)
- [CVE-2025-27232](https://cve.now/CVE-2025-27232.md): Frontend arbitrary file read in oauth.authorize action (CVSS 6.8, Zabbix)
- [CVE-2025-12106](https://cve.now/CVE-2025-12106.md): Insufficient argument validation in OpenVPN 2.7\_alpha1 through 2.7\_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP (CVSS 9.1, OpenVPN)
- [CVE-2025-13296](https://cve.now/CVE-2025-13296.md): CSRF in Tekrom Technology's T-Soft E-Commerce (CVSS 5.4, Tekrom Technology T-Soft E-Commerce)
- [CVE-2025-58408](https://cve.now/CVE-2025-58408.md): GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code (CVSS 5.9, Imagination Technologies Graphics DDK)
- [CVE-2025-41070](https://cve.now/CVE-2025-41070.md): Reflected Cross-site Scripting (XSS) in Sanoma's Clickedu (CVSS 4.8, Sanoma Clickedu)
- [CVE-2025-6349](https://cve.now/CVE-2025-6349.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 5.1, Arm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…)
- [CVE-2025-8045](https://cve.now/CVE-2025-8045.md): Mali GPU Kernel Driver allows improper GPU processing operations (CVSS 4.0, Arm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…)
- [CVE-2025-2879](https://cve.now/CVE-2025-2879.md): Mali GPU Kernel Driver allows improper GPU processing operations (CVSS 5.1, Arm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…)
- [CVE-2025-59789](https://cve.now/CVE-2025-59789.md): Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser (CVSS 7.5, Apache Software Foundation Apache bRPC)
- [CVE-2025-41700](https://cve.now/CVE-2025-41700.md): CODESYS Development System - Deserialization of Untrusted Data (CVSS 7.8, CODESYS Development System)
- [CVE-2025-41738](https://cve.now/CVE-2025-41738.md): CODESYS Control - Invalid type usage in visualization (CVSS 7.5, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2025-41739](https://cve.now/CVE-2025-41739.md): CODESYS Control - Linux/QNX SysSocket flaw (CVSS 5.9, CODESYS PLCHandler · CODESYS Remote Target Visu +14)
- [CVE-2025-13819](https://cve.now/CVE-2025-13819.md): Open redirect in web server of MiR robots and MiR fleet (CVSS 6.1, MiR Robot · MiR Fleet)
- [CVE-2025-13816](https://cve.now/CVE-2025-13816.md): moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal (CVSS 5.3, moxi159753 Mogu Blog)
- [CVE-2025-13815](https://cve.now/CVE-2025-13815.md): moxi159753 Mogu Blog v2 pictures unrestricted upload (CVSS 5.3, moxi159753 Mogu Blog)
- [CVE-2025-61610](https://cve.now/CVE-2025-61610.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61609](https://cve.now/CVE-2025-61609.md): In modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61608](https://cve.now/CVE-2025-61608.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61607](https://cve.now/CVE-2025-61607.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61619](https://cve.now/CVE-2025-61619.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61618](https://cve.now/CVE-2025-61618.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-61617](https://cve.now/CVE-2025-61617.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-3012](https://cve.now/CVE-2025-3012.md): In dpc modem, there is a possible system crash due to null pointer dereference. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-11133](https://cve.now/CVE-2025-11133.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-11132](https://cve.now/CVE-2025-11132.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-11131](https://cve.now/CVE-2025-11131.md): In nr modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2025-13814](https://cve.now/CVE-2025-13814.md): moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery (CVSS 6.9, moxi159753 Mogu Blog)
- [CVE-2025-13813](https://cve.now/CVE-2025-13813.md): moxi159753 Mogu Blog v2 Storage Management Endpoint storage authorization (CVSS 6.3, moxi159753 Mogu Blog)
- [CVE-2025-13811](https://cve.now/CVE-2025-13811.md): jsnjfz WebStack-Guns PageFactory.java sql injection (CVSS 5.3, jsnjfz WebStack-Guns)
- [CVE-2025-13810](https://cve.now/CVE-2025-13810.md): jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal (CVSS 6.9, jsnjfz WebStack-Guns)
- [CVE-2025-13809](https://cve.now/CVE-2025-13809.md): orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery (CVSS 5.3, orionsec orion-ops)
- [CVE-2025-13808](https://cve.now/CVE-2025-13808.md): orionsec orion-ops User Profile UserController.java update improper authorization (CVSS 6.9, orionsec orion-ops)
- [CVE-2025-13807](https://cve.now/CVE-2025-13807.md): orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization (CVSS 5.3, orionsec orion-ops)
- [CVE-2025-13806](https://cve.now/CVE-2025-13806.md): nutzam NutzBoot Transaction API EthModule.java improper authorization (CVSS 6.9, nutzam NutzBoot · org.nutz:nutzboot-parent)
- [CVE-2025-13805](https://cve.now/CVE-2025-13805.md): nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization (CVSS 6.3, nutzam NutzBoot · org.nutz:nutzboot-parent)
- [CVE-2025-13804](https://cve.now/CVE-2025-13804.md): nutzam NutzBoot Ethereum Wallet EthModule.java information disclosure (CVSS 5.3, nutzam NutzBoot · org.nutz:nutzboot-parent)
- [CVE-2025-13803](https://cve.now/CVE-2025-13803.md): MediaCrush Header paths.py http headers for scripting syntax (CVSS 6.9, MediaCrush)
- [CVE-2025-13802](https://cve.now/CVE-2025-13802.md): jairiidriss RestaurantWebsite Make a Reservation cross site scripting (CVSS 5.3, jairiidriss RestaurantWebsite)
- [CVE-2025-13800](https://cve.now/CVE-2025-13800.md): ADSLR NBR1005GPEV2 send\_order.cgi set\_mesh\_disconnect command injection (CVSS 5.3, ADSLR NBR1005GPEV2)
- [CVE-2025-13799](https://cve.now/CVE-2025-13799.md): ADSLR NBR1005GPEV2 send\_order.cgi ap\_macfilter\_del command injection (CVSS 5.3, ADSLR NBR1005GPEV2)
- [CVE-2025-13798](https://cve.now/CVE-2025-13798.md): ADSLR NBR1005GPEV2 send\_order.cgi ap\_macfilter\_add command injection (CVSS 5.3, ADSLR NBR1005GPEV2)
- [CVE-2025-64772](https://cve.now/CVE-2025-64772.md): The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Li (CVSS 7.8, Sony INZONE Hub)
- [CVE-2025-13797](https://cve.now/CVE-2025-13797.md): ADSLR B-QE2W401 send\_order.cgi parameterdel\_swifimac command injection (CVSS 5.3, ADSLR B-QE2W401)
- [CVE-2024-32384](https://cve.now/CVE-2024-32384.md): Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. (CVSS 6.8)
- [CVE-2024-32388](https://cve.now/CVE-2024-32388.md): Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. (CVSS 5.3)
- [CVE-2024-39148](https://cve.now/CVE-2024-39148.md): The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to e (CVSS 8.1)
- [CVE-2024-56089](https://cve.now/CVE-2024-56089.md): An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake responses by reviving the b (CVSS 7.5)
- [CVE-2025-51682](https://cve.now/CVE-2025-51682.md): mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to adminis (CVSS 9.8)
- [CVE-2025-51683](https://cve.now/CVE-2025-51683.md): A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a cr (CVSS 9.8)
- [CVE-2025-57489](https://cve.now/CVE-2025-57489.md): Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to t (CVSS 8.1)
- [CVE-2025-61228](https://cve.now/CVE-2025-61228.md): An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism (CVSS 7.8)
- [CVE-2025-61229](https://cve.now/CVE-2025-61229.md): An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p (CVSS 8.4)
- [CVE-2025-63095](https://cve.now/CVE-2025-63095.md): Improper input validation in the BitstreamWriter::write\_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a De (CVSS 6.5)
- [CVE-2025-63317](https://cve.now/CVE-2025-63317.md): Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. (CVSS 5.4)
- [CVE-2025-63365](https://cve.now/CVE-2025-63365.md): SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. (CVSS 7.1)
- [CVE-2025-63520](https://cve.now/CVE-2025-63520.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate). (CVSS 6.1, feehi/feehicms)
- [CVE-2025-63522](https://cve.now/CVE-2025-63522.md): Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function (CVSS 4.6, feehi/feehicms)
- [CVE-2025-63523](https://cve.now/CVE-2025-63523.md): FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticat (CVSS 6.5, feehi/feehicms)
- [CVE-2025-63525](https://cve.now/CVE-2025-63525.md): An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges vi (CVSS 9.6)
- [CVE-2025-63526](https://cve.now/CVE-2025-63526.md): A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component. (CVSS 8.5)
- [CVE-2025-63527](https://cve.now/CVE-2025-63527.md): A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php comp (CVSS 8.5)
- [CVE-2025-63528](https://cve.now/CVE-2025-63528.md): A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component. (CVSS 8.5)
- [CVE-2025-63529](https://cve.now/CVE-2025-63529.md): A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's (CVSS 6.1)
- [CVE-2025-63531](https://cve.now/CVE-2025-63531.md): A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. (CVSS 10.0)
- [CVE-2025-63532](https://cve.now/CVE-2025-63532.md): A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. (CVSS 9.6)
- [CVE-2025-63533](https://cve.now/CVE-2025-63533.md): A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php comp (CVSS 8.5)
- [CVE-2025-63534](https://cve.now/CVE-2025-63534.md): A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component. (CVSS 8.5)
- [CVE-2025-63535](https://cve.now/CVE-2025-63535.md): A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. (CVSS 9.6)
- [CVE-2025-64030](https://cve.now/CVE-2025-64030.md): Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/se (CVSS 5.4)
- [CVE-2025-65403](https://cve.now/CVE-2025-65403.md): A buffer overflow in the g\_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 6.5)
- [CVE-2025-65404](https://cve.now/CVE-2025-65404.md): A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) (CVSS 6.5)
- [CVE-2025-65405](https://cve.now/CVE-2025-65405.md): A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a (CVSS 6.5)
- [CVE-2025-65406](https://cve.now/CVE-2025-65406.md): A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause (CVSS 6.5)
- [CVE-2025-65407](https://cve.now/CVE-2025-65407.md): A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Den (CVSS 6.5)
- [CVE-2025-65408](https://cve.now/CVE-2025-65408.md): A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 all (CVSS 6.5)
- [CVE-2025-65621](https://cve.now/CVE-2025-65621.md): Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator (CVSS 5.4, snipe/snipe-it)
- [CVE-2025-65622](https://cve.now/CVE-2025-65622.md): Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript (CVSS 5.4, snipe/snipe-it)
- [CVE-2025-65836](https://cve.now/CVE-2025-65836.md): PublicCMS V5.202506.b is vulnerable to SSRF. (CVSS 9.1)
- [CVE-2025-65838](https://cve.now/CVE-2025-65838.md): PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method. (CVSS 7.5)
- [CVE-2025-65840](https://cve.now/CVE-2025-65840.md): PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.