İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2025: sömürülen ve yeni ciddi CVE kayıtları

164 kayıt · 11 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2025-34322
    37İzleyin

    Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

    YüksekCVSS 8,6Kavram kanıtıEPSS %9

    nagios · log server17 Kas 2025

  • CVE-2025-13223
    66Bu hafta

    Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %4

    google · chrome17 Kas 2025

  • CVE-2025-13224
    35İzleyin

    Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome17 Kas 2025

  • CVE-2025-48593
    32İzleyin

    In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free.

    YüksekCVSS 8,0Kavram kanıtıEPSS %0

    google · android18 Kas 2025

  • CVE-2025-63892
    27İzleyin

    A vulnerability was determined in SourceCodester Student Grades Management System 1.0.

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    remyandrade · student grades management system18 Kas 2025

  • CVE-2025-63408
    31İzleyin

    Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    ispyconnect · agent dvr18 Kas 2025

  • CVE-2025-56526
    24İzleyin

    Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    cinnamon · kotaemon18 Kas 2025

  • CVE-2025-56643
    36İzleyin

    Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out.

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    requarks · wiki.js18 Kas 2025

  • CVE-2025-54320
    17İzleyin

    In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerabilit

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    ascertia · signinghub18 Kas 2025

  • CVE-2025-54321
    39İzleyin

    In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerabi

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    ascertia · signinghub18 Kas 2025

  • CVE-2025-56499
    26İzleyin

    Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated p

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    metacubex · mihomo18 Kas 2025

  • CVE-2025-63602
    29İzleyin

    A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) a

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    awesomeminer · awesome miner18 Kas 2025

  • CVE-2025-34324
    28İzleyin

    GoSign Desktop < 2.4.1 Insecure Update Mechanism RCE

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    infocert · gosign18 Kas 2025

  • CVE-2025-58034
    74Bu hafta

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %54

    fortinet · fortiweb18 Kas 2025

  • CVE-2025-64408
    28İzleyin

    Apache Causeway: Java deserialization vulnerability to authenticated attackers

    OrtaCVSS 6,3İstismar yokEPSS %10

    apache · causeway19 Kas 2025

  • CVE-2025-64764
    21İzleyin

    Astro is vulnerable to Reflected XSS via the server islands feature

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    astro · astro19 Kas 2025

  • CVE-2025-13315
    60Bu hafta

    Unauthenticated log access in Twonky Server

    KritikCVSS 9,3SilahlaştırılmışEPSS %32

    linux · linux kernel19 Kas 2025

  • CVE-2025-13316
    60Bu hafta

    Hard-coded encryption keys in Twonky Server

    YüksekCVSS 8,2SilahlaştırılmışEPSS %2

    linux · linux kernel19 Kas 2025

  • CVE-2025-65099
    30İzleyin

    Claude Code vulnerable to command execution prior to startup trust dialog

    YüksekCVSS 7,7Kavram kanıtıEPSS %0

    anthropic · claude code19 Kas 2025

  • CVE-2025-65094
    34İzleyin

    WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    wbce · wbce cms19 Kas 2025

  • CVE-2025-11001
    39İzleyin

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %26

    7-zip · 7-zip19 Kas 2025

  • CVE-2025-63848
    24İzleyin

    Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    swi-prolog · swish20 Kas 2025

  • CVE-2025-64027
    24İzleyin

    Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    snipeitapp · snipe-it20 Kas 2025

  • CVE-2025-63888
    39İzleyin

    The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    thinkphp · thinkphp20 Kas 2025

  • CVE-2025-0643
    28İzleyin

    XSS in Narkom Communication Technologies' Pyxis Signage

    YüksekCVSS 7,2İstismar yokEPSS %0

    narkom communication and software technologies trade ltd. co. · pyxis signage20 Kas 2025

  • CVE-2025-13442
    28İzleyin

    UTT 进取 750W formPdbUpConfig system command injection

    OrtaCVSS 5,5İstismar yokEPSS %19

    utt · 750w firmware20 Kas 2025

  • CVE-2025-13425
    7İzleyin

    Denial of Service in OSV-SCALIBR

    DüşükCVSS 1,9Kavram kanıtıEPSS %0

    google · osv-scalibr20 Kas 2025

  • CVE-2025-61138
    30İzleyin

    Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.

    YüksekCVSS 7,5İstismar yokEPSS %0

    qlik · qlik sense20 Kas 2025

  • CVE-2025-11368
    21İzleyin

    LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    thimpress · learnpress – wordpress lms plugin for create and sell online courses21 Kas 2025

  • CVE-2025-11771
    21İzleyin

    Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    beycanpress · cryptocurrency (token), launchpad (presale), ico & ido, airdrop by tokenico21 Kas 2025

  • CVE-2025-12135
    28İzleyin

    WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    iqonicdesign · wpbookit21 Kas 2025

  • CVE-2025-13159
    28İzleyin

    Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    flothemesplugins · flo forms – easy drag & drop form builder21 Kas 2025

  • CVE-2025-11973
    19İzleyin

    简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read

    OrtaCVSS 4,9Kavram kanıtıEPSS %0

    zhengdon · 简数采集器21 Kas 2025

  • CVE-2025-13156
    35İzleyin

    Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    appsbd · vitepos – point of sale (pos) for woocommerce21 Kas 2025

  • CVE-2025-13138
    30İzleyin

    WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    wpdirectorykit · wp directory kit21 Kas 2025

  • CVE-2025-41115
    44Planlayın

    Incorrect privilege assignment

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    grafana · grafana21 Kas 2025

  • CVE-2025-12973
    28İzleyin

    S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    oc3dots · s2b ai assistant – chatbot, ai agents, chatgpt api, image generator21 Kas 2025

  • CVE-2025-48507
    34İzleyin

    The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors acces

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    amd · kria™ som23 Kas 2025

  • CVE-2024-14015
    28İzleyin

    Studiocart <= 2.9.0 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    unknown · wordpress ecommerce plugin24 Kas 2025

  • CVE-2025-63914
    26İzleyin

    An issue was discovered in Cinnamon kotaemon 0.11.0.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    cinnamon · kotaemon24 Kas 2025

  • CVE-2025-63498
    24İzleyin

    alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    alinto · sogo24 Kas 2025

  • CVE-2025-64720
    28İzleyin

    LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    libpng · libpng25 Kas 2025

  • CVE-2025-65018
    28İzleyin

    LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    libpng · libpng25 Kas 2025

  • CVE-2025-6389
    62Bu hafta

    Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback

    KritikCVSS 9,8Kavram kanıtıEPSS %76

    sneeit · sneeit framework25 Kas 2025

  • CVE-2025-13380
    26İzleyin

    AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    liquidthemes · ai engine for wordpress: chatgpt, gpt content generator25 Kas 2025

  • CVE-2025-59366
    41Planlayın

    An authentication-bypass vulnerability exists in AiCloud.

    KritikCVSS 9,2İstismar yokEPSS %15

    asus · router25 Kas 2025

  • CVE-2025-63729
    36İzleyin

    An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certif

    KritikCVSS 9,0Kavram kanıtıEPSS %0

    syrotech · sy-gpon-1110-wdont firmware25 Kas 2025

  • CVE-2025-63735
    24İzleyin

    A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal end

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    ruckuswireless · ruckus unleashed25 Kas 2025

  • CVE-2025-58360
    87Hemen

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %60

    geoserver · geoserver25 Kas 2025

  • CVE-2025-13595
    39İzleyin

    CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    soportecibeles · cibeles ai25 Kas 2025

  • CVE-2025-13597
    39İzleyin

    AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    soportecibeles · ai feeds25 Kas 2025

  • CVE-2025-59390
    39İzleyin

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · druid26 Kas 2025

  • CVE-2025-65669
    36İzleyin

    An issue was discovered in classroomio 0.1.13.

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    classroomio · classroomio26 Kas 2025

  • CVE-2025-65672
    30İzleyin

    Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    classroomio · classroomio26 Kas 2025

  • CVE-2025-65675
    21İzleyin

    Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    classroomio · classroomio26 Kas 2025

  • CVE-2025-65676
    21İzleyin

    Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    classroomio · classroomio26 Kas 2025

  • CVE-2025-65681
    13İzleyin

    An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to se

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    edly · tutor26 Kas 2025

  • CVE-2025-50433
    39İzleyin

    An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to tak

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    monnit · imonnit26 Kas 2025

  • CVE-2025-65670
    17İzleyin

    An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    classroomio · classroomio26 Kas 2025

  • CVE-2025-62593
    86Hemen

    Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

    KritikCVSS 9,4KEVSilahlaştırılmışEPSS %62

    anyscale · ray26 Kas 2025

  • CVE-2025-66031
    34İzleyin

    node-forge ASN.1 Unbounded Recursion

    YüksekCVSS 8,7İstismar yokEPSS %0

    digitalbazaar · forge26 Kas 2025

  • CVE-2025-12758
    30İzleyin

    Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the

    YüksekCVSS 7,7Kavram kanıtıEPSS %0

    validator project · validator27 Kas 2025

  • CVE-2025-66034
    39İzleyin

    fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    fonttools · fonttools29 Kas 2025

  • CVE-2025-66224
    36İzleyin

    OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection

    KritikCVSS 9,0Kavram kanıtıEPSS %0

    orangehrm · orangehrm29 Kas 2025