CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- containerdcontainerd CRI server: Host memory exhaustion through Attach goroutine leak6.9 Medium
- red hat single sign-on 7Rhsso: open redirect6.1 Medium
- advantech deviceon/iedge, deviceon\/iedge +1 moreAdvantech DeviceOn/iEdge Path Traversal8.7 High
- advantech deviceon/iedge, deviceon\/iedge +1 moreAdvantech DeviceOn/iEdge Path Traversal8.7 High
- advantech deviceon/iedge, deviceon\/iedge +1 moreAdvantech DeviceOn/iEdge Path Traversal8.7 High
- advantech deviceon/iedge, deviceon\/iedge +1 moreAdvantech DeviceOn/iEdge Cross-site Scripting5.3 Medium
- ubia ubox android, ubox ios +1 moreUbia Ubox7.1 High
- 3scale porta, red hat 3scale api management platform 2 +1 more3scale-porta: readonly fields not validated server-side7.5 High
- matiasdesuu thinkdashboardThinkDashboard: Stored XSS in Dashboard via Malicious Bookmark5.4 Medium
- matiasdesuu thinkdashboardThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature5.3 Medium
- nicholas j humfrey ruby-mqtt, red hat satellite 6 +1 moreRubygem-mqtt: rubygem-mqtt hostname validation7.4 High
- matiasdesuu thinkdashboardThinkDashboard: Blind Server-Side Request Forgery (SSRF) vulnerability in /api/ping Endpoint5.3 Medium
- ibm openpagesIBM OpenPages Vulnerable to HTML Injection5.4 Medium
- heimdall data database proxyHeimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability8.8 High
- oobabooga text-generation-webuioobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability9.8 Critical
- oobabooga text-generation-webuioobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability9.8 Critical
- evernote-mcp-serverevernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability7.8 High
- netgate pfsenseNetgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability8.8 High
- salesagility suitecrmSuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality8.8 High
- salesagility suitecrmSuiteCRM < 7.12.6 SQL Injection via 'export' Functionality9.3 Critical
- d-link dir-1260, dlink dir-1260 firmware +1 moreD-Link DIR-1260 <= v1.20B05 GetDeviceSettings Unauthenticated Command Injection9.3 Critical
- advantech iviewAdvantech iView < v5.7.04 Build 6425 ztp_search_value Parameter SQL Injection RCE9.3 Critical
- advantech iviewAdvantech iView < v5.7.04 Build 6425 ztp_config_id Parameter SQL Injection Information Disclosure8.8 High
- advantech iviewAdvantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCE9.3 Critical
- advantech iviewAdvantech iView < v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCE9.3 Critical
- advantech iviewAdvantech iView < v5.7.04 Build 6425 data Parameter SQL Injection Information Disclosure8.8 High
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via NetworksController.addNetworkAction()5.1 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()5.3 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()5.3 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxDeviceFwRulesAction()5.3 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()5.3 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()8.6 High
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()5.3 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()8.6 High
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()8.6 High
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()6.9 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction()6.3 Medium
- advantech webaccess/vpn, webaccess\/vpn +1 moreAdvantech WebAccess/VPN < 1.1.5 Stored XSS via NetworksController.addNetworkAction()6.2 Medium
- dell idrac10 firmware, idrac9 firmware, integrated dell remote access controller 10 17g version +2 more +4 moreDell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G...6.7 Medium
- aws research and engineering studio (res)An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another us…5.3 Medium
- autodesk installerPrivilege Escalation Vulnerability7.8 High
- devolutions serverImproper privilege management during pre-MFA cookie handling in Devolutions Server 2025.3.5.0 and...8.8 High
- devolutions serverImproper access control in Devolutions Server 2025.3.5.0 and earlier allows a View-only user to...6.5 Medium
- edge-themes alloggio - hotel bookingWordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerability8.1 High
- icopydoc import from ymlWordPress Import from YML plugin <= 3.1.17 - Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods grand conference theme custom post type, grand conference +1 moreWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- appscreo easy social share buttonsWordPress Easy Social Share Buttons plugin < 10.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- booster for woocommerce, pluggabl booster for woocommerce +1 moreWordPress Booster for WooCommerce plugin <= 7.2.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability10.0 Critical
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability9.8 Critical
- Show moreLoading…