Several high and critical vulnerabilities were discovered in various software products in late November 2025. HexStrike AI's MCP server is susceptible to command injection, potentially allowing root privilege escalation. AMD products including AMD uProf and Xilinx Run Time (XRT) have issues ranging from KSLR bypass to integer overflows and use-after-free conditions. ASR Lapwing_Linux contains an out-of-bounds read vulnerability, while the Blubrry PowerPress plugin for WordPress allows arbitrary file uploads. Chanjet CRM and several code-projects applications including COVID Tracking System, Jonnys Liquor, Library System, and Question Paper Generator are vulnerable to SQL injection attacks. Cursor software has a command injection vulnerability, enabling arbitrary code execution. Dassault Systmes' DELMIA Service Process Engineer and ENOVIA Product Manager are affected by stored cross-site scripting vulnerabilities. The Tiger theme for WordPress and FindAll Listing plugin suffer from privilege escalation, and the FindAll Membership plugin has an authentication bypass flaw. Eaton Galileo Software is vulnerable to path traversal allowing unauthorized code execution, and FACTION framework allows remote code execution via untrusted extensions.