CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- alexreservations alex reservations: smart restaurant bookingAlex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreGallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion4.3 Medium
- smub athemes addons for elementoraThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget6.4 Medium
- saphali liqpay for donateSaphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- gregross cyan backupCYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion6.5 Medium
- kybernetikservices quick featured imagesQuick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned4.9 Medium
- academylms academy lms proAcademy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'5.3 Medium
- kodezen academy lms – wordpress lms plugin for complete elearning solutionAcademy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'7.2 High
- wpdesk flexible refund and return order for woocommerceFlexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update5.3 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation4.3 Medium
- codesolz better find and replace – ai-powered suggestionsBetter Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection8.8 High
- linksoftware html forms – simple wordpress forms pluginHTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- htplugins insert headers and footers code – ht scriptInsert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- getwpfunnels wpfunnels – funnel builder for woocommerce with checkout & one click upsellWPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal6.5 Medium
- itthinx groupsGroups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join4.3 Medium
- kitae-park mang board wpMang Board WP <= 2.3.1 - Reflected Cross-Site Scripting6.1 Medium
- burhandodhy smart auto upload images – import external imagesSmart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- stevejburge tag, category, and taxonomy manager – ai autotagger with openaiTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection4.9 Medium
- ovatheme events managerOvatheme Events Manager <= 1.8.6 - Missing Authorization6.5 Medium
- getwpfunnels wpfunnels – funnel builder for woocommerce with checkout & one click upsellWPFunnels <= 3.6.2 - Unauthorized User Registration5.3 Medium
- f1logic wp2social auto publishWP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage6.1 Medium
- werbeagenturcommotion course booking systemCourse Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export5.3 Medium
- codename065 download managerDownload Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key5.3 Medium
- rnzo connect contact form 7 and aweberContact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset4.3 Medium
- neofix simple downloads listSimple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- asgaros forumAsgaros Forum <= 3.1.0 - Unauthenticated SQL Injection7.5 High
- salesagility suitecrm, suitecrm suitecrm-core +1 moreSuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL6.5 Medium
- salesagility suitecrm, suitecrm suitecrm-core +1 moreSuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection8.8 High
- salesagility suitecrmSuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page6.1 Medium
- salesagility suitecrmSuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass8.3 High
quickjsOSS-FuzzHeap-use-after-free in JS_DefinePropertyNo score- salesagility suitecrmSuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass8.3 High
- salesagility suitecrmSuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module8.6 High
- kovidgoyal calibrecalibre is vulnerable to arbitrary code execution when opening FB2 files9.3 Critical
- google chromeInsufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140...5.4 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80...5.4 Medium
- cvat-ai cvatCVAT: Mounted share file overwrite via crafted request5.3 Medium
pdfminerDebian,pdfminer-sixPyPI,python-pdfminer.sixopenEuler +2 moreInsecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc6.5 Medium- elastic cloud enterprise, cloud enterprise (ece) +1 moreElastic Cloud Enterprise Improper Authorization8.8 High
- beijing star-net ruijie network technology co., ltd. eg3210, eg3220, eg3230 +34 more +36 moreRuijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCE9.2 Critical
- revenera installshieldPotential Denial of Service in Supported Versions of Revenera InstallShield5.6 Medium
- pdfminer pdfminer.six, debian linux +1 morepdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input8.6 High
- mrubymruby array.c ary_fill_exec out-of-bounds write4.8 Medium
- humhubHumHub is vulnerable to XSS through its Meta Search component7.1 High
- solidigm™ d5-p5316, d7-p5510, d7-p5520/d7-p5620, d5-p5430, d5-p5336Improper resource management in firmware of some Solidigm DC Products may allow an attacker with...4.4 Medium
- solidigm™ d5-p5316, d5-p5430, d7-p5520/d7-p5620, d5-p5336Improper resource management in firmware of some Solidigm DC Products may allow an attacker with...4.4 Medium
- ibm db2IBM Db2 denial of service6.5 Medium
- ibm db2IBM Db2 denial of service6.5 Medium
- ibm db2IBM Db2 information disclosure4.6 Medium
- Show moreLoading…