Week 48, 2025

24 November to 30 November 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 467
Critical: 71
High: 149
Added to KEV: 1

Critical 71High 149Medium 226Low 21Not scored 0All 467 in the list

Added to KEVAttackers use these now; patch them first

CVE-2021-26829
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Product not named
ExploitedMedium5.4

Most severe new CVEsBy CVSS score

CVE-2025-64128
Zenitel TCIV-3+ OS Command Injection
Zenitel · TCIV-3+
Critical10.0
CVE-2025-64127
Zenitel TCIV-3+ OS Command Injection
Zenitel · TCIV-3+
Critical10.0
CVE-2025-64126
Zenitel TCIV-3+ OS Command Injection
Zenitel · TCIV-3+
Critical10.0
CVE-2025-66261
Unauthenticated OS Command Injection (restore_settings.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9
CVE-2025-66253
Unauthenticated OS Command Injection (start_upgrade.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9
CVE-2025-54347
A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to…
Product not named
Critical9.9
CVE-2025-66256
Unauthenticated Arbitrary File Upload (patch_contents.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9
CVE-2025-12421
Account Takeover via Code Exchange Endpoint
Mattermost · Mattermost
Critical9.9
CVE-2025-66255
Unauthenticated Arbitrary File Upload (upgrade_contents.php)
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Critical9.9
CVE-2025-12419
Account takeover on OAuth/OpenID-enabled servers
Mattermost · Mattermost
Critical9.9

Week 48, 2025

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses