CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- deco-cx apps deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery 5.3 Medium
- codingwithelias school management system codingWithElias School Management System Edit Student Info student-view.php cross site scripting 4.8 Medium
- 0x4m4 hexstrike ai HexStrike AI MCP Server Command Injection 9.1 Critical
- winston-dsouza ecommerce-website winston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting 5.3 Medium
- No product listed Qualitor getResumo.php eval code injection 6.9 Medium
- scada-lts Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal 5.3 Medium
- scada-lts Scada-LTS cross-site request forgery 5.3 Medium
- zentao ZenTao model.php makeRequest server-side request forgery 5.3 Medium
- chanjet crm Chanjet CRM upgradeattribute.php sql injection 6.9 Medium
- zentao ZenTao File control.php delete privileges management 5.3 Medium
- taosir wtcms taosir WTCMS index.php fetch code injection 6.9 Medium
- yungifez skuul, skuul school management system +1 more yungifez Skuul School Management System Image profile information disclosure 5.3 Medium
- yungifez skuul, skuul school management system +1 more yungifez Skuul School Management System SVG File edit cross site scripting 4.8 Medium
- taosir wtcms taosir WTCMS CommentadminController CommentadminController.class.php delete sql injection 5.3 Medium
- taosir wtcms taosir WTCMS SlideController SlideController.class.php delete sql injection 6.9 Medium
- phpface streamtube core StreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change 9.8 Critical
- wisc htcondor HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on... 4.2 Medium
- oxide omicron In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration... 5.0 Medium
- motogadget mo.lock ignition lock motogadget mo.lock Ignition Lock NFC hard-coded key 1.0 Low
- mariadb MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability 7.0 High
- orangehrm OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments 5.3 Medium
- orangehrm OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments 5.3 Medium
- orangehrm OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change 8.7 High
- orangehrm OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow 8.7 High
- orangehrm OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection 9.0 Critical
- openobserve OpenObserve's Invite Token Lifecycle Misconfiguration 8.4 High
- pallets werkzeug Werkzeug safe_join() allows Windows special device names 6.3 Medium
- accellion kiteworks, kiteworks security-advisories +1 more Kiteworks Core is vulnerable to Improper Input Validation 6.3 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 more Kiteworks MFT has a Privilege Defined With Unsafe Actions 6.5 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 more Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel 7.2 High
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 more Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability 6.8 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 more Kiteworks MFT is vulnerable to Insufficient Session Expiration 7.1 High
- aiscatcher ais-catcher AIS-catcher has a Buffer Overflow vulnerability in `AIS::Message` leading to DoS/RCE 9.3 Critical
- aiscatcher ais-catcher AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow 8.8 High
- danny-avila librechat LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability 8.6 High
- anjaliavv51 retro Retro is vulnerable to XSS vulnerability in input handling component 6.1 Medium
- fonttools fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib 6.3 Medium
- lukevella rallly Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings 7.1 High
- ricardoboss pubnet PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofing 9.4 Critical
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 more ClipBucket v5 Unauthenticated Object Flagging Vulnerability 6.5 Medium
-
quickjsOSS-Fuzz Heap-buffer-overflow in re_parse_term No score -
kimageformatsOSS-Fuzz Use-of-uninitialized-value in decoder_context::construct_reference_picture_lists No score - cilium Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic 4.0 Medium
- krpano Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote... 6.1 Medium
- exrick xmall Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling... 6.1 Medium
- devolutions server, remote desktop manager +1 more Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on... 6.5 Medium
-
lz4-javaDebian,org.lz4:lz4-javaMaven,at.yawk.lz4:lz4-javaMaven +9 more +11 more org.lz4:lz4-java - Out-of-Bounds Memory Access 8.8 High -
edk2Ubuntu edk2 regression No score - netskope client Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver 5.9 Medium
- apache kvrocks Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins 5.3 Medium
- Show olderLoading…