CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- jgwhite33 wp airbnb review sliderWP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting4.0 Medium
- conda constructor(conda) Constructor: Excessive permissions during and after installation7.8 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name5.1 Medium
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5: Stored XSS Vulnerability in Manage Playlists7.2 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title7.2 High
- themeatelier idonate, idonate – blood donation, request and donor management system +1 moreIDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function6.5 Medium
- themeatelier idonate, idonate – blood donation, request and donor management system +1 moreIDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function8.8 High
- gravity forms formsGravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'9.8 Critical
- bridgehead software filestore, sangoma freepbx +1 moreFreePBX Administration GUI is Vulnerable to Authenticated Command Injection8.6 High
- niaj connector wizard (formerly lc wizard)LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation8.1 High
- manager-io managerManager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)10.0 Critical
- nec corporation clusterpro x for linux (expresscluster x for linux), clusterpro x singleserversafe for linux (expresscluster x singleserversafe for linux) +1 moreCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from...9.3 Critical
- vercel ai, ai sdk +1 moreVercel’s AI SDK's filetype whitelists can be bypassed when uploading files3.7 Low
- nuxt devtools, vercel nuxt devtools +1 moreNuxt DevTools vulnerable to cross-site scripting (XSS)6.9 Medium
swiftDebianswift - security updateNo score- onlookA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the...6.1 Medium
- onlookAn Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web...6.5 Medium
- onlookA Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project...7.6 High
- pamzey patients waiting area queue management systemA SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System)...6.5 Medium
- mayurik pet grooming management softwareThe change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet...6.5 Medium
- rems leads manager toolThe SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF)...6.5 Medium
- remyandrade modern user account generatorCross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows...6.1 Medium
- remyandrade matching type testCross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote...6.1 Medium
- pig4cloud pigIn pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System...9.6 Critical
- pig4cloud pigIn pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz...9.1 Critical
- ycf1998 money-posMultiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit...10.0 Critical
- rymcu forestAn issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in...6.5 Medium
- guominjim personmanageThere is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit...6.5 Medium
- rems medicine reminder appSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the ...6.1 Medium
- remyandrade faq bot with ai assistantThe chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable...6.1 Medium
- remyandrade ai-powered to-do list appSourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the ...6.1 Medium
- nooncarlett techstoreTechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter.6.1 Medium
- nooncarlett techstoreTechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the...6.1 Medium
- crushftpA stored cross-site scripting (XSS) vulnerability in the CrushFTP 11.3.7_50 Admin Panel (Reports ...4.1 Medium
- angular, ckeditor ckeditor5 +1 moreA reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows...5.4 Medium
- webair tquadra cmsA Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue...7.5 High
- astrbotAstrBot contains a directory traversal vulnerability7.5 High
- astrbotAstrBot has an arbitrary file read vulnerability in function _encode_image_bs646.5 Medium
- google chromeInappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137...4.2 Medium
- google chromeInappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137...4.2 Medium
- google chromeInappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote...8.8 High
- google chromeInappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed...7.5 High
- google chromeOut of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote...8.8 High
- charmbracelet soft-serveSoft Serve does not sanitize ANSI escape sequences in user input4.6 Medium
- kubevirtKubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes5.0 Medium
- kubevirtKubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes6.9 Medium
- kubevirtKubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation5.3 Medium
- kubevirtKubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing4.7 Medium
- kubevirtKubeVirt Arbitrary Container File Read6.5 Medium
- kubevirtKubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer4.7 Medium
- Show moreLoading…