CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- nagios xiNagios XI < 5.8.7 XSS in Core UI Views URL handling5.1 Medium
- nagios xiNagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host9.4 Critical
- nagios xiNagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure6.0 Medium
- treeverse lakefslakeFS: Unauthenticated access to API usage metrics5.3 Medium
- lenovo idea tab pro tb373fu, tab extreme tb570zu tb570fu, tab k11 plus lte tb352fu tb352xu +16 more +18 moreA potential vulnerability was reported in some Lenovo Tablets that could allow a local...6.8 Medium
- ibm cloud pak for business automationMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for 24.0.0-IF007, 24.0.1-IF005 and 25.0.0-IF0026.4 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreMalformed KMIP response may result in access violation5.9 Medium
- openmage magento, magento-lts +1 moreOpenMage is vulnerable to XSS in Admin Notifications4.6 Medium
- mantisbtMantisBT unauthorized disclosure of private project column configuration5.3 Medium
- mantisbtMantisBT: Authentication bypass for some passwords due to PHP type juggling5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability7.1 High
kernelTuxCare,kernel-abi-stablelistsTuxCare,kernel-coreTuxCare +54 more +56 moreUpdate of kernelNo score- lighttpdHTTP Header Smuggling via Trailer Merge6.9 Medium
- proofpoint insider threat management (itm) server, insider threat management server +1 moreInsider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass...2.3 Low
- mantisbtMantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length6.5 Medium
- mantisbtMantisBT: Authentication bypass for some passwords due to PHP type juggling8.8 High
- guetebruck g-camUnauthenticated SQL Injection in Guetebruck G-Cam Series Cameras9.8 Critical
- sailpoint identityiqIncorrect Content Type Cross-Site Scripting Vulnerability7.1 High
- react native community cli, react-native-community react native community cli +1 moreCommand injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests9.8 Critical
- ibm cloud pak for business automationsecurity vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.4.8 Medium
- ibm cloud pak for business automationIBM Business Automation Insights improper input validation6.5 Medium
- ibm cloud pak for business automationIBM Business Automation Insights unverified ownership4.3 Medium
- hp client management script libraryHP Client Management Script Library – Security Update8.5 High
binutilsTuxCare,binutils-aarch64-linux-gnuTuxCare,binutils-alpha-linux-gnuTuxCare +32 more +34 moreFix CVE(s): CVE-2025-1000876No score- dreamstechnologies doccure coreDoccure Core < 1.5.4 - Unauthenticated Privilege Escalation9.8 Critical
- d3wp wp snow effectWordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability5.3 Medium
- jeecgboot jeewx-bootjeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal5.3 Medium
- linuxcan: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled5.7 Medium
- cb project ltd. co. cvlandIDOR in CB Project's CVLand9.9 Critical
- eaton brightlayer software suite (blss)The privileged user could log in without sufficient credentials after enabling an application...7.1 High
- fushengqian fuintfushengqian fuint Authentication Token ClientSignController.java authorization2.3 Low
- eaton brightlayer software suite (blss)Arbitrary code execution is possible due to improper validation of the file upload functionality...8.3 High
- tenda ac10, ac10 firmware +1 moreTenda AC10 SysRunCmd formSysRunCmd buffer overflow8.7 High
- tenda a15, a15 firmware +1 moreTenda A15 openNetworkGateway fromSetWirelessRepeat buffer overflow8.7 High
- digiwin easyflow .net, easyflow ainet +1 moreDigiwin｜EasyFlow .NET and EasyFlow AiNet7.1 High
- tenda ac8, ac8 firmware +1 moreTenda AC8 DatabaseIniSet buffer overflow8.7 High
- angeljudesuarez billing systemitsourcecode Billing System login_crud.php sql injection6.9 Medium
- phpgurukul news portalPHPGurukul News Portal settings.py insertion of sensitive information into debugging code6.3 Medium
- phpgurukul news portalPHPGurukul News Portal settings.py hard-coded key2.3 Low
- mayurik best house rental management systemSourceCodester Best House Rental Management System admin_class.php delete_payment sql injection5.1 Medium
- campcodes school fees payment management systemCampcodes School Fees Payment Management System ajax.php sql injection5.3 Medium
- tenda ac21, ac21 firmware +1 moreTenda AC21 SetPptpServerCfg formSetPPTPServer buffer overflow8.7 High
- code-projects gym management systemCodeAstro Gym Management System view-progress-report.php sql injection5.1 Medium
- code-projects gym management systemCodeAstro Gym Management System update-progress.php sql injection5.1 Medium
- angeljudesuarez online loan management systemitsourcecode Online Loan Management System manage_user.php sql injection6.9 Medium
- angeljudesuarez online loan management systemitsourcecode Online Loan Management System manage_payment.php sql injection6.9 Medium
openexrOSS-FuzzUNKNOWN READ in ojph::local::param_cod::~param_codNo score- getgrav gravGrav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- car-booking-system-php project car-booking-system-phpCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.9.8 Critical
- car-booking-system-php project car-booking-system-phpCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.9.4 Critical
- Show moreLoading…