Week 48, 2025
24 November to 30 November 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 467CVEs publishedin the whole week
- 71CriticalCVSS 9.0 and above
- 149HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2021-26829
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Product not named
ExploitedMedium5.4
Most severe new CVEsBy CVSS score
- CVE-2025-64128
Zenitel TCIV-3+ OS Command Injection
Zenitel · TCIV-3+
Critical10.0 - CVE-2025-64127
Zenitel TCIV-3+ OS Command Injection
Zenitel · TCIV-3+
Critical10.0 - CVE-2025-64126
Zenitel TCIV-3+ OS Command Injection
Zenitel · TCIV-3+
Critical10.0 - CVE-2025-66261
Unauthenticated OS Command Injection (restore_settings.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9 - CVE-2025-66253
Unauthenticated OS Command Injection (start_upgrade.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9 - CVE-2025-54347
A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to…
Product not named
Critical9.9 - CVE-2025-66256
Unauthenticated Arbitrary File Upload (patch_contents.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9 - CVE-2025-12421
Account Takeover via Code Exchange Endpoint
Mattermost · Mattermost
Critical9.9 - CVE-2025-66255
Unauthenticated Arbitrary File Upload (upgrade_contents.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9 - CVE-2025-12419
Account takeover on OAuth/OpenID-enabled servers
Mattermost · Mattermost
Critical9.9