Weekly digest
Week 48, 2025 (24–30 Nov)
A quiet week: only 128 new CVEs against a recent average of about 419. Of those, 8 critical and 38 high. 4 arrived with exploitation evidence or public exploit code already attached. No new KEV entries. huawei was the most-affected vendor with 14.
New this week, ranked by depth score
The 12 that matter most of the 128 published.
CVE-2025-62593High· 8.8CISA KEVPoCRay is an AI compute engine
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient gu…
CVE-2025-50433Critical· 9.8PoCAn issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.
CVE-2025-13615Critical· 9.8The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78
The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization a…
CVE-2025-66219Critical· 9.8willitmerge is a command line tool to check if pull requests are mergeable
willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure ch…
CVE-2025-66216Critical· 9.8AIS-catcher is a multi-platform AIS receiver
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of a…
CVE-2025-64130Critical· 9.8Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.
Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.
CVE-2025-61168Critical· 9.8An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.
An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.
CVE-2025-12758High· 7.5PoCVersions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E)…
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E)…
CVE-2025-65112Critical· 9.4PubNet is a self-hosted Dart & Flutter package service
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables …
CVE-2025-34351CriticalRay's New Token Authentication is Disabled By Default
Ray's New Token Authentication is Disabled By Default
CVE-2024-14015High· 7.1PoCThe WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users s…
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users s…
CVE-2025-62703High· 8.8Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
Most-affected vendors
By CVEs published in the period.