CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- ibm business automation workflow containers, business automation workflow traditional with process federation server, business automation workflow +1 more +3 moreCross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -6.1 Medium
- wpchill strong testimonialsStrong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution4.3 Medium
- codesolz better find and replace – ai-powered suggestionsBetter Find and Replace <= 1.7.7 - Missing Authorization4.3 Medium
- mitsubishi electric corporation melsec iq-f series fx5s-30mr/ds, melsec iq-f series fx5s-30mr/es, melsec iq-f series fx5s-30mr/es-a +80 more +82 moreDenial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU module5.3 Medium
- nerdpressteam hubbub lite – fast, free social sharing and follow buttonsHubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting6.1 Medium
- asus armoury crateA improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys...7.3 High
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url4.3 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation5.3 Medium
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload4.3 Medium
- growi, inc. growiCross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates...4.8 Medium
- yudiz easy email subscriptionEasy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion4.3 Medium
- yudiz easy email subscriptionEasy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uid4.9 Medium
- dataeaseDataEase is vulnerable to Oracle JNDI Injection8.9 High
quickjsOSS-FuzzUse-of-uninitialized-value in JS_DefinePropertyNo score- cmsimple-xh cmsimple xhA reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker...7.1 High
- cmsimple-xh cmsimple xhAn unauthenticated reflected cross-site scripting vulnerability in the query handling of...7.1 High
- kiloview e3 firmwareAn issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows...7.5 High
- metinfoA Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity ...7.5 High
- alexusmai laravel file manageralexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application...8.1 High
- linshenkx prompt optimizerA Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer...7.3 High
- elspec-ltd g5dfr firmwareOn Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the...6.8 Medium
- anydeskAn issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my...8.2 High
- anydeskAn issue was discovered in AnyDesk before 9.0.0. It has an integer overflow and resultant heap...9.8 Critical
- anydeskAn issue was discovered in AnyDesk through 9.0.4. Remote Denial of Service can occur because of...7.5 High
- anydeskAn issue was discovered in AnyDesk through 9.0.4. When the connection between two clients is...7.5 High
- dataeaseDataEase's DB2 is vulnerable to SSRF8.9 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin6.5 Medium
- hcl software devops loopHCL DevOps Loop is susceptible to an improper authentication vulnerability8.1 High
- amazon workspacesImproper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions...8.8 High
- langchain-ai langgraphLangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer7.4 High
- parse-community parse-serverParse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format7.5 High
- zitadelIDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering8.7 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding5.2 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products6.1 Medium
- weblateWeblate leaks the IP of project members inviting users to assume reviewer roles in Audit log2.6 Low
- youki-dev youkiyouki container escape and denial of service due to arbitrary write gadgets and procfs write redirects7.3 High
- youki-dev youkiyouki container escape via "masked path" abuse due to mount race conditions7.3 High
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed by restricting options offered on a locked device. This issue is fixed...4.6 Medium
- bellard quickjsQuickJS quickjs.c js_array_buffer_slice buffer over-read4.8 Medium
- wso2 api manager, enterprise integrator, micro integrator +8 more +10 moreArbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)8.4 High
- hcl software iautomate, hcltech dryice iautomate +1 moreHCL iAutomate is susceptible to a sensitive information disclosure5.4 Medium
- drupal simple multi step form, simple multi step form project multi step form +1 moreSimple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-1163.5 Low
- drupal email tfa, email tfa project tfa +1 moreEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-1155.4 Medium
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution8.4 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration6.5 Medium
- dell command monitor (dcm), command monitor +1 moreDell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary...7.3 High
- dell cloudlinkDell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may...6.7 Medium
- dell cloudlinkDell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky...6.7 Medium
- dell cloudlinkDell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be...5.3 Medium
- dell cloudlin, cloudlink +1 moreDell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with...9.1 Critical
- Show moreLoading…