CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- cisco identity services engine software, identity services engine +1 moreMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC...5.4 Medium
- cisco identity services engine software, identity services engine +1 moreA vulnerability in the web-based management interface of Cisco ISE could allow an authenticated,...4.3 Medium
- cisco identity services engine software, identity services engine +1 moreMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC...4.8 Medium
- cisco identity services engine software, identity services engine +1 moreMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC...5.4 Medium
- dell cloudlinkDell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known...8.4 High
- cisco unified intelligence center, packaged contact center enterprise, unified contact center enterprise +1 more +3 moreCisco Unified Intelligence Center API Information Disclosure Vulnerability4.3 Medium
- cisco unified contact center expressCisco Unified Contact Center Express Arbitrary File Upload Vulnerability6.5 Medium
- cisco unified contact center expressCisco Unified Contact Center Express Remote Code Execution Vulnerability6.5 Medium
- cisco unified contact center expressCisco Unified Contact Center Express Arbitrary File Download Vulnerability4.9 Medium
- cisco unified contact center expressCisco Unified Contact Center Express Editor Authentication Bypass Vulnerability9.4 Critical
- cisco unified contact center expressCisco Unified Contact Center Express Remote Code Execution Vulnerability9.8 Critical
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Radius Suppression Denial of Service Vulnerability8.6 High
- dell cloudlinkDell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known...8.4 High
- dell cloudlinkDell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A...9.1 Critical
- djangoproject djangoPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows7.5 High
- entr'ouvert lassoA type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr&...9.8 Critical
- entr'ouvert lassoA denial of service vulnerability exists in the lasso_provider_verify_saml_signature...7.5 High
- entr'ouvert lassoA denial of service vulnerability exists in the lasso_node_init_from_message_with_format...7.5 High
- entr'ouvert lassoA denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'...7.5 High
- wso2 api control plane, api manager, enterprise integrator +6 more +8 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution6.7 Medium
- hcl software bigfix queryHCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query application4.2 Medium
- averta premium portfolio features for phlox themePremium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]8.1 High
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field6.4 Medium
- amans2k funnelkit automations – email marketing automation and crm for wordpress & woocommerce, funnelkit automations +1 moreFunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending4.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure5.3 Medium
- amans2k funnelkit automations – email marketing automation and crm for wordpress & woocommerce, funnelkit automations +1 moreFunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure5.3 Medium
- brecht visual link previewVisual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode6.4 Medium
- iqonicdesign graphina – charts and graphs for elementorGraphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets6.4 Medium
- apache doris mcp server, apache software foundation doris-mcp-server +1 moreApache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server5.4 Medium
- bmc control-m/agentBMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution9.5 Critical
- curl, siemens ruggedcom rst2428p +1 moremissing SFTP host verification with wolfSSH4.3 Medium
- the foreman foreman, red hat satellite 6, satellite 6.15 for rhel 8 +4 more +6 moreForeman: os command injection via ct_location and fcct_location parameters8.0 High
- kiotviet sync, mykiot kiotviet sync +1 moreKiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass5.3 Medium
- kiotviet sync, mykiot kiotviet sync +1 moreKiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- kiotviet sync, mykiot kiotviet sync +1 moreKiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- kiotviet sync, mykiot kiotviet sync +1 moreKiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure5.3 Medium
- bplugins document embedder – embed pdfs, word, excel, and other filesDocument Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation8.6 High
- bplugins carousel block – responsive image and content carouselB Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
- princeahmed file manager for google drive – integrate google driveFile Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure7.5 High
- averta depicter — popup & slider builderPopup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Con…4.3 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed6.4 Medium
- sony corporation optical disc archive software (for windows)Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an...8.4 High
- roboticsware pte. ltd. ba-panel6, fa-panel6, fa-server6 +1 more +3 moreMultiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with...8.4 High
- amd epyc™ 9005 series processors, ryzen™ 9000hx series processors +1 moreImproper handling of insufficient entropy in the AMD CPUs could allow a local attacker to...7.2 High
- unknown ace user managementAce User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest6.3 Medium
- unknown melabu wp download counter buttonDownload Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download5.3 Medium
- element invader elementinvader addons for elementorElementinvader Addons for Elementor < 1.4.1 – Unauthenticated Arbitrary Email Sending5.3 Medium
- unknown funnelkitFunnelKit < 3.12.0.1 - Reflected XSS6.3 Medium
- samsung membersImproper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to...7.1 High
- samsung smart switchUse of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows...8.8 High
- Show moreLoading…