Week 47, 2025

17 November to 23 November 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 731
Critical: 55
High: 194
Added to KEV: 3

Critical 55High 194Medium 448Low 32Not scored 2All 731 in the list

Added to KEVAttackers use these now; patch them first

CVE-2025-61757
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0…
Oracle Corporation · Identity Manager
ExploitedCritical9.8
CVE-2025-13223
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8
CVE-2025-58034
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0…
Fortinet · FortiWeb
ExploitedMedium6.7

Most severe new CVEsBy CVSS score

CVE-2025-41115
Incorrect privilege assignment
Grafana · Grafana Enterprise
Critical10.0
CVE-2025-65108
md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter
simonhaenisch · md-to-pdf
Critical10.0
CVE-2025-49752
Azure Bastion Elevation of Privilege Vulnerability
Microsoft · Azure Bastion Developer
Critical10.0
CVE-2025-63216
The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid…
Product not named
Critical10.0
CVE-2025-63224
The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid…
Product not named
Critical10.0
CVE-2025-63207
The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on…
Product not named
Critical9.8
CVE-2025-59245
Microsoft SharePoint Online Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Online
Critical9.8
CVE-2025-60738
An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute…
Product not named
Critical9.8
CVE-2025-63213
The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the…
Product not named
Critical9.8
CVE-2025-63228
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php…
Product not named
Critical9.8

Week 47, 2025

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses