CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- samsung emailImproper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to...3.3 Low
- samsung accountImproper handling of insufficient permissions or privileges in Samsung Account prior to version...5.5 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote...4.3 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote...4.3 Medium
- samsung android, samsung mobile devices +1 moreInsecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows...6.8 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1...5.7 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation9.8 Critical
- stellarwp the events calendarThe Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s7.5 High
- brainstormforce spectra gutenberg blocks – website builder for the block editorSpectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS6.4 Medium
- cozmoslabs paid membership subscriptions – effortless memberships, recurring payments & content restrictionPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal5.3 Medium
- stanleychoi sms for wordpressSMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting6.1 Medium
- wpeverest everest forms proEverest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature5.6 Medium
- klicher featuresFeatures <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset4.3 Medium
- silentmatt expr-eval, expr-eval-fork, jorenbroekema javascript expression evaluator +2 moreCVE-2025-127359.8 Critical
- djangoproject djangoPotential SQL injection via _connector keyword argument in QuerySet and Q objects9.1 Critical
- snipeitapp snipe-itSnipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an...9.9 Critical
- opensource-socialnetwork open source social networkOSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status...6.5 Medium
- selfbestA DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows...6.1 Medium
- selfbestA Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest...7.2 High
- selfbest** exclusively-hosted-service ** A Stored Cross-Site Scripting (XSS) vulnerability in the chat...9.1 Critical
- magdesign pocketvj control panel firmwarePocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution...9.8 Critical
- diaowen dwsurveyDWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire,...7.5 High
- dynatrace activegate ping extensionOS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted...9.8 Critical
- No product listedMDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle...7.1 High
- xiaozhangbang voluntary like systemA vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to...6.5 Medium
- libarchiveAn issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution...5.5 Medium
- owncloud guestsownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests...5.3 Medium
- openkmOpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user...5.4 Medium
- zwiicmsAn Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6...8.3 High
- cdprojekt gog galaxyGOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the...6.8 Medium
- tonec internet download managerTonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate...9.1 Critical
- quipuxQuipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via...9.9 Critical
- quipuxQuipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean...5.3 Medium
- quipuxCross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php...6.5 Medium
- anysphere cursorCursor: Authentication Bypass Possible via New Cursorignore Write8.7 High
- cursorCursor CLI Beta: Command Injection via Untrusted MCP Configuration8.8 High
- anysphere cursorCursor's Sensitive File Modification can Lead to NTFS Path Quirks8.8 High
- anysphere cursorCursor is Vulnerable to Path Manipulation Using Backslashes on Windows8.8 High
- absolute secure accessCVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12...6.0 Medium
- anysphere cursorCursor: Speedbump Modal Bypass in MCP Server Deep-Link8.8 High
- absolute secure accessCVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure...8.2 High
- kovah linkaceLinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature8.7 High
- kovah linkaceLinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags7.1 High
- kovah linkaceLinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links7.1 High
- kovah linkaceLinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality2.3 Low
- fuji electric monitouch v-sft-6, fujielectric monitouch v-sft +1 moreFuji Electric Monitouch V-SFT-6 Stack-based Buffer Overflow8.4 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5: Stored XSS via Collection Tags5.3 Medium
- fuji electric monitouch v-sft-6, fujielectric monitouch v-sft +1 moreFuji Electric Monitouch V-SFT-6 Heap-based Buffer Overflow8.4 High
- xibosignage xibo, xibo-cms +1 moreXibo CMS: Remote Code Execution through module templates7.2 High
- galetteGalette is vulnerable to XSS through Document Type5.3 Medium
- Show moreLoading…