Security Vulnerabilities - CVEs Published In November 2025
A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score
7.8
EPSS Score
0.002
Published
2025-11-12
An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.
CVSS Score
9.8
EPSS Score
0.004
Published
2025-11-12
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file
CVSS Score
9.1
EPSS Score
0.002
Published
2025-11-12
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.
CVSS Score
9.8
EPSS Score
0.013
Published
2025-11-12
A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.
CVSS Score
9.8
EPSS Score
0.003
Published
2025-11-12
N-central < 2025.4 is vulnerable to authentication bypass via path traversal
CVSS Score
9.4
EPSS Score
0.006
Published
2025-11-12
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
CVSS Score
10.0
EPSS Score
0.006
Published
2025-11-12
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
CVSS Score
8.4
EPSS Score
0.307
Published
2025-11-12
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
CVSS Score
9.8
EPSS Score
0.005
Published
2025-11-12
Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints without authentication.
CVSS Score
7.5
EPSS Score
0.005
Published
2025-11-12