# CVEs published 2025-12-03

94 CVEs were published on December 3, 2025: 11 critical, 33 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-62173](https://cve.now/CVE-2025-62173.md): Authenticated SQL Injection in Endpoint Module Rest API (CVSS 8.6, FreePBX restapps)
- [CVE-2025-66404](https://cve.now/CVE-2025-66404.md): mcp-server-kubernetes potential security issue in exec\_in\_pod tool (CVSS 6.4, Flux159 mcp-server-kubernetes · mcp-server-kubernetes)
- [CVE-2025-66293](https://cve.now/CVE-2025-66293.md): LIBPNG has an out-of-bounds read in png\_image\_read\_composite (CVSS 7.1, pnggroup libpng)
- [CVE-2025-13086](https://cve.now/CVE-2025-13086.md): Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7\_alpha1 through 2.7\_rc1 allows an attacker to open (CVSS 4.6, OpenVPN)
- [CVE-2025-66489](https://cve.now/CVE-2025-66489.md): Cal.com Authentication Bypass via bad TOTP + password checks (CVSS 9.9, calcom cal.com)
- [CVE-2025-65097](https://cve.now/CVE-2025-65097.md): Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections (CVSS 7.1, rommapp romm)
- [CVE-2025-65096](https://cve.now/CVE-2025-65096.md): RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections (CVSS 5.3, rommapp romm)
- [CVE-2025-12385](https://cve.now/CVE-2025-12385.md): Improper validation of \<img\> tag size in Text component parser (CVSS 8.7, Qt)
- [CVE-2025-61727](https://cve.now/CVE-2025-61727.md): Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 (CVSS 6.5, Go standard library crypto/x509 · stdlib)
- [CVE-2025-65027](https://cve.now/CVE-2025-65027.md): RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover (CVSS 7.6, rommapp romm)
- [CVE-2025-66453](https://cve.now/CVE-2025-66453.md): Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function (CVSS 5.5, mozilla rhino · org.mozilla:rhino)
- [CVE-2025-66411](https://cve.now/CVE-2025-66411.md): Coder logged sensitive objects unsanitized (CVSS 7.8, coder · github.com/coder/coder/v2 +1)
- [CVE-2025-66406](https://cve.now/CVE-2025-66406.md): Improper Authorization Check for SSH Certificate Revocation (CVSS 5.0, smallstep certificates · github.com/smallstep/certificates)
- [CVE-2025-13992](https://cve.now/CVE-2025-13992.md): Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site (CVSS 4.7, Google Chrome)
- [CVE-2025-12819](https://cve.now/CVE-2025-12819.md): Untrusted search path in auth\_query connection in PgBouncer (CVSS 7.5, PgBouncer)
- [CVE-2025-12084](https://cve.now/CVE-2025-12084.md): Quadratic complexity in node ID cache clearing (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2024-3884](https://cve.now/CVE-2024-3884.md): Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded (CVSS 7.5, Red Hat JBoss Enterprise Application Platform 7.1 EUS f… +19)
- [CVE-2025-66222](https://cve.now/CVE-2025-66222.md): DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) (CVSS 9.7, ThinkInAIXYZ deepchat)
- [CVE-2025-66220](https://cve.now/CVE-2025-66220.md): Envoy’s TLS certificate matcher for \`match\_typed\_subject\_alt\_names\` may incorrectly treat certificates containing an embedded null byte (CVSS 5.0, envoyproxy envoy · github.com/envoyproxy/envoy)
- [CVE-2025-66208](https://cve.now/CVE-2025-66208.md): Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy (CVSS 7.2, CollaboraOnline online)
- [CVE-2025-33208](https://cve.now/CVE-2025-33208.md): NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. (CVSS 8.8, NVIDIA TAO)
- [CVE-2025-66032](https://cve.now/CVE-2025-66032.md): Claude Code Command Validation Bypass Allows Arbitrary Code Execution (CVSS 8.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-33211](https://cve.now/CVE-2025-33211.md): NVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-33201](https://cve.now/CVE-2025-33201.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exceptional conditions (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-64763](https://cve.now/CVE-2025-64763.md): Envoy forwards early CONNECT data in TCP proxy mode (CVSS 3.7, envoyproxy envoy · github.com/envoyproxy/envoy)
- [CVE-2025-64527](https://cve.now/CVE-2025-64527.md): Envoy crashes when JWT authentication is configured with the remote JWKS fetching (CVSS 6.5, envoyproxy envoy · github.com/envoyproxy/envoy)
- [CVE-2025-64443](https://cve.now/CVE-2025-64443.md): DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode (CVSS 7.3, docker mcp-gateway · github.com/docker/mcp-gateway)
- [CVE-2025-54065](https://cve.now/CVE-2025-54065.md): GZDoom engine allows arbitrary code execution via ZScript actor states (CVSS 7.8, gzdoom)
- [CVE-2025-20388](https://cve.now/CVE-2025-20388.md): Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise (CVSS 2.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20389](https://cve.now/CVE-2025-20389.md): Improper Input Validation in "label" column field in Splunk Secure Gateway App (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform +1)
- [CVE-2025-20387](https://cve.now/CVE-2025-20387.md): Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade (CVSS 8.0, Splunk Enterprise)
- [CVE-2025-20383](https://cve.now/CVE-2025-20383.md): Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform +1)
- [CVE-2025-20384](https://cve.now/CVE-2025-20384.md): Unauthenticated Log Injection in Splunk Enterprise (CVSS 5.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20386](https://cve.now/CVE-2025-20386.md): Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade (CVSS 8.0, Splunk Enterprise)
- [CVE-2025-20385](https://cve.now/CVE-2025-20385.md): Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise (CVSS 2.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-20381](https://cve.now/CVE-2025-20381.md): SPL commands allowlist controls bypass in Splunk MCP Server app through "run\_splunk\_query" MCP tool (CVSS 5.4, Splunk MCP Server)
- [CVE-2025-20382](https://cve.now/CVE-2025-20382.md): URL validation bypass through Views Dashboard in Splunk Enterprise (CVSS 3.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2025-34319](https://cve.now/CVE-2025-34319.md): TOTOLINK N300RT \<= V2.1.8-B20201030.1539 Boa formWsc RCE (CVSS 9.3, TOTOLINK N300RT)
- [CVE-2024-32643](https://cve.now/CVE-2024-32643.md): Masa CMS vulnerable to authentication bypass with /tag/ (CVSS 7.5, MasaCMS)
- [CVE-2024-32642](https://cve.now/CVE-2024-32642.md): Host header poisoning allows account takeover via password reset email (CVSS 8.8, MasaCMS)
- [CVE-2025-13492](https://cve.now/CVE-2025-13492.md): HP Image Assistant - Potential Escalation of Privilege (CVSS 5.4, HP Image Assistant)
- [CVE-2024-32641](https://cve.now/CVE-2024-32641.md): Masa CMS Vulnerable to Pre-Auth RCE via JSON API (CVSS 9.8, MasaCMS)
- [CVE-2025-13751](https://cve.now/CVE-2025-13751.md): Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7\_alpha1 through 2.7\_rc2 on Windows allows a local authenticated use (CVSS 1.3, OpenVPN)
- [CVE-2025-7044](https://cve.now/CVE-2025-7044.md): Privilege Escalation in MAAS via Websocket Request Manipulation (CVSS 7.7, Ubuntu MAAS)
- [CVE-2025-55182](https://cve.now/CVE-2025-55182.md): A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu (CVSS 10.0, KEV, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-13949](https://cve.now/CVE-2025-13949.md): ProudMuBai GoFilm FileController.go SingleUpload unrestricted upload (CVSS 5.3, ProudMuBai GoFilm)
- [CVE-2025-13948](https://cve.now/CVE-2025-13948.md): opsre go-ldap-admin JWT docker-compose.yaml hard-coded key (CVSS 6.3, opsre go-ldap-admin)
- [CVE-2025-13359](https://cve.now/CVE-2025-13359.md): Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI \<= 3.40.1 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2025-13756](https://cve.now/CVE-2025-13756.md): Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution \<= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management (CVSS 4.3, techjewel Fluent Booking – The Ultimate Appointments Schedu…)
- [CVE-2025-13401](https://cve.now/CVE-2025-13401.md): Autoptimize \<= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, optimizingmatters Autoptimize)
- [CVE-2025-13390](https://cve.now/CVE-2025-13390.md): WP Directory Kit \<= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover (CVSS 10.0, listingthemes WP Directory Kit)
- [CVE-2025-13354](https://cve.now/CVE-2025-13354.md): Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI \<= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation (CVSS 4.3, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2025-13109](https://cve.now/CVE-2025-13109.md): HUSKY – Products Filter Professional for WooCommerce \<= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof\_add\_query/woof\_remove\_query' (CVSS 4.3, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2025-12358](https://cve.now/CVE-2025-12358.md): ShopEngine \<= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation (CVSS 4.3, roxnor ShopEngine Elementor WooCommerce Builder Addon – All…)
- [CVE-2025-13342](https://cve.now/CVE-2025-13342.md): Frontend Admin by DynamiApps \<= 3.28.20 - Unauthenticated Arbitrary Options Update (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2025-12887](https://cve.now/CVE-2025-12887.md): Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App \<= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update (CVSS 5.4, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2025-39665](https://cve.now/CVE-2025-39665.md): Livestatus Injection in dynmaps (CVSS 6.9, Nagvis)
- [CVE-2025-13947](https://cve.now/CVE-2025-13947.md): Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop (CVSS 7.4, The WebKitGTK Team webkitgtk · Red Hat Enterprise Linux… +1)
- [CVE-2025-13472](https://cve.now/CVE-2025-13472.md): Missing authorization in BlazeMeter Jenkins Plugin (CVSS 5.3, Perforce BlazeMeter · com.blazemeter.plugins:BlazeMeterJenk…)
- [CVE-2025-12744](https://cve.now/CVE-2025-12744.md): Abrt: command-injection in abrt leading to local privilege escalation (CVSS 8.8, abrt · Red Hat Enterprise Linux)
- [CVE-2025-29864](https://cve.now/CVE-2025-29864.md): Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before (CVSS 6.2, ESTsoft ALZip)
- [CVE-2025-13946](https://cve.now/CVE-2025-13946.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2025-13945](https://cve.now/CVE-2025-13945.md): Improperly Controlled Sequential Memory Allocation in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2025-13486](https://cve.now/CVE-2025-13486.md): Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare\_form (CVSS 9.8, hwk-fr Advanced Custom Fields: Extended)
- [CVE-2025-12954](https://cve.now/CVE-2025-12954.md): Timetable and Event Schedule by MotoPress \< 2.4.16 - Contributor+ Event Disclosure via IDOR (CVSS 2.7, Timetable and Event Schedule by MotoPress)
- [CVE-2025-10304](https://cve.now/CVE-2025-10304.md): Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin \<= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure (CVSS 5.3, everestthemes Everest Backup – WordPress Cloud Backup, Migr…)
- [CVE-2025-12585](https://cve.now/CVE-2025-12585.md): MxChat – AI Chatbot for WordPress \<= 2.5.5 - Unauthenticated Information Exposure (CVSS 5.3, MxChat – AI Chatbot & Content Generation for WordPress)
- [CVE-2025-13495](https://cve.now/CVE-2025-13495.md): FluentCart A New Era of eCommerce \<= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter (CVSS 4.9, wpmanageninja FluentCart A New Era of eCommerce – Faster, L…)
- [CVE-2025-13646](https://cve.now/CVE-2025-13646.md): Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition (CVSS 7.5, wpchill Image Gallery – Photo Grid & Video Gallery)
- [CVE-2025-13448](https://cve.now/CVE-2025-13448.md): CSSIgniter Shortcodes \<= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute (CVSS 6.4, anastis CSSIgniter Shortcodes)
- [CVE-2025-13645](https://cve.now/CVE-2025-13645.md): Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion (CVSS 7.2, wpchill Image Gallery – Photo Grid & Video Gallery)
- [CVE-2025-50360](https://cve.now/CVE-2025-50360.md): A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. (CVSS 8.4)
- [CVE-2025-50361](https://cve.now/CVE-2025-50361.md): Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12\_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe (CVSS 5.1)
- [CVE-2025-53841](https://cve.now/CVE-2025-53841.md): The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52. (CVSS 7.8, Akamai Guardicore Platform Agent)
- [CVE-2025-53965](https://cve.now/CVE-2025-53965.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, (CVSS 5.3)
- [CVE-2025-54326](https://cve.now/CVE-2025-54326.md): An issue was discovered in Camera in Samsung Mobile Processor Exynos 1280 and 2200. (CVSS 7.5)
- [CVE-2025-55076](https://cve.now/CVE-2025-55076.md): A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4. (CVSS 6.2)
- [CVE-2025-57198](https://cve.now/CVE-2025-57198.md): AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i (CVSS 8.8)
- [CVE-2025-57199](https://cve.now/CVE-2025-57199.md): AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i (CVSS 8.8)
- [CVE-2025-57200](https://cve.now/CVE-2025-57200.md): AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i (CVSS 6.5)
- [CVE-2025-57201](https://cve.now/CVE-2025-57201.md): AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i (CVSS 8.8)
- [CVE-2025-57202](https://cve.now/CVE-2025-57202.md): A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1 (CVSS 6.1)
- [CVE-2025-62686](https://cve.now/CVE-2025-62686.md): A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installati (CVSS 6.2)
- [CVE-2025-63401](https://cve.now/CVE-2025-63401.md): Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary c (CVSS 5.5)
- [CVE-2025-63402](https://cve.now/CVE-2025-63402.md): An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforc (CVSS 5.5)
- [CVE-2025-64055](https://cve.now/CVE-2025-64055.md): An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions (CVSS 9.8)
- [CVE-2025-65267](https://cve.now/CVE-2025-65267.md): In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious Jav (CVSS 9.0)
- [CVE-2025-65320](https://cve.now/CVE-2025-65320.md): Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. (CVSS 7.5)
- [CVE-2025-65345](https://cve.now/CVE-2025-65345.md): alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. (CVSS 6.5, alexusmai/laravel-file-manager)
- [CVE-2025-65841](https://cve.now/CVE-2025-65841.md): Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file ~/Library/Application Support/Aquarius/aquarius. (CVSS 6.2)
- [CVE-2025-65842](https://cve.now/CVE-2025-65842.md): The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. (CVSS 5.1)
- [CVE-2025-65843](https://cve.now/CVE-2025-65843.md): Aquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. (CVSS 7.7)
- [CVE-2025-65868](https://cve.now/CVE-2025-65868.md): XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST reques (CVSS 9.1)
- [CVE-2025-66431](https://cve.now/CVE-2025-66431.md): WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via (CVSS 7.8, Plesk)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.