CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- code-projects online job search enginecode-projects Online Job Search Engine login.php sql injection6.9 Medium
- hundred plus eip plusHundred Plus｜EIP Plus - Weak Password Recovery Mechanism9.3 Critical
- dedebizDedeBIZ archives_add.php sql injection5.1 Medium
- e-excellence u-office forcee-Excellence｜U-Office Force - SQL Injection8.7 High
- e-excellence u-office forcee-Excellence｜U-Office Force - SQL Injection8.7 High
- janobe farm management systemSourceCodester Farm Management System review.php sql injection5.3 Medium
- rymcu forestrymcu forest UserDicController.java deleteDic authorization6.9 Medium
- rymcu forestrymcu forest BankController.java GlobalResult authorization5.3 Medium
- 1000mz chestnutcmsliweiyi ChestnutCMS download resourceDownload path traversal5.1 Medium
libicalOSS-FuzzHeap-buffer-overflow in icalmemory_tmp_copyNo score- neo4j community edition, openclinica +1 moreOpenClinica Community Edition CRF Data Import ImportCRFData path traversal5.3 Medium
- linuxcontainers incusIncus vulnerable to local privilege escalation through custom storage volumes8.6 High
- tenda ac18 firmwareA stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The...8.8 High
- tenda ac18 firmwareA stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi...5.4 Medium
- senior-walter web-based pharmacy product management systemCross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User...8.8 High
- lerouxyxchire client database management systemA Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database...7.1 High
- pijey simple public chat roomThe send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to...6.5 Medium
- chuck24 simple to-do list systemA Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0...5.4 Medium
- cmsmadesimple file managerAn authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple...7.2 High
- kutangguo ktg-mesktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. This is...6.5 Medium
- rickxy hospital management systemThe patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy...7.1 High
- tenda ax1803 firmwareTenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the...7.5 High
- tenda ax1803 firmwareTenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the...7.5 High
- tenda ax3 firmwareTenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed...7.5 High
- oneflowImproper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via...6.5 Medium
- chipsalliance rocketchipA vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the...6.5 Medium
- keruistore kerui k259 firmwareKERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution...6.5 Medium
- open5gsIn Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in...7.5 High
- totolink a7000r firmwareTOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the...7.5 High
- totolink a7000r firmwareTOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid...7.5 High
- tenda ax3 firmwareTenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto...7.5 High
- tenda ax3 firmwareTenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the...7.5 High
- tenda ax3 firmwareTenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of...7.5 High
- busybox, siemens ruggedcom rst2428p +1 moreBusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP...6.5 Medium
- No product listedAn issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level...6.5 Medium
- neo4j community edition, openclinica +1 moreOpenClinica Community Edition CRF Data Import ImportCRFData xml injection5.3 Medium
- foxcmsqianfox FoxCMS Product.php edit cross site scripting4.8 Medium
- evershopEverShop Order Order.resolvers.js resource injection6.3 Medium
- yungifez skuul, skuul school management system +1 moreyungifez Skuul School Management System View Fee Invoice fee-invoices resource injection2.3 Low
- xapiXAPI UTF-8 string handling9.4 Critical
- xen windows pv driversWinPVDrivers: Excessive permissions on user-exposed devices9.4 Critical
- xen windows pv driversWinPVDrivers: Excessive permissions on user-exposed devices9.4 Critical
- xen windows pv driversWinPVDrivers: Excessive permissions on user-exposed devices9.4 Critical
- tozed zlt t10, gztozed zlt t10 plus firmware +1 moreTOZED ZLT T10 Reboot proc_post denial of service5.3 Medium
- linuxcrypto: rng - Ensure set_ent is always present7.3 High
- linuxserial: qcom-geni: Fix blocked taskNo score
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System Frontend portal_login command injection5.3 Medium
- 70mai x200, x200 firmware +1 more70mai X200 Init Script file inclusion7.1 High
- aapanel baotaaaPanel BaoTa Backend database sql injection5.1 Medium
- code-projects responsive hotel sitecode-projects Responsive Hotel Site roomdel.php sql injection5.1 Medium
- Show moreLoading…