CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- academysoftwarefoundation openexrOpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()5.5 Medium
- academysoftwarefoundation openexrOpenEXR Makes Use of Uninitialized Memory2.0 Low
- changedetection, dgtlmoon changedetection.io +1 morechangedetection.io vulnerable to stored XSS in Watch update via API3.5 Low
- combodo itopCombodo iTop vulnerable to reflected XSS in webservices/export.php7.1 High
- combodo itopiTop admin can drop iTop database using webhooks8.7 High
- cyclonedx cyclonedx-core-javaCycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection7.5 High
- combodo itopCombodo iTop vulnerable to IDOR with ModuleInstallation object4.3 Medium
- combodo itopCombodo iTop vulnerable to reflected XSS via objection edition form error8.8 High
- combodo itopCombodo iTop has stored XSS in user portal's browse brick8.5 High
- ibm cognos analytics certified containersIBM Cognos Analytics Certified Containers information disclosure5.3 Medium
- combodo itopCombodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard8.8 High
- combodo itopCombodo iTop has XSS vulnerability in /pages/ajax.render.php8.8 High
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0,...5.9 Medium
rust-sudo-rsUbunturust-sudo-rs vulnerabilitiesNo score- combodo itopCombodo iTop vulnerable to Remote Code Execution in the backup creation functionality8.6 High
- aws go wrapper, jdbc wrapper, nodejs wrapper +2 more +4 moreAWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance8.6 High
- qualys inc agentLocal Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents6.3 Medium
- dell display and peripheral managerDell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with...7.3 High
- gladinet triofoxTriofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw...9.1 Critical
- jetbrains dottrace, resharper, resharper, rider and dottrace +1 more +3 moreIn JetBrains dotTrace before 2025.2.5 local privilege escalation possible via race condition4.2 Medium
- jetbrains resharperIn JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows...8.4 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data...8.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form4.5 Medium
- jetbrains hubIn JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API5.3 Medium
- jetbrains hubIn JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit2.7 Low
- jetbrains hubIn JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via...2.7 Low
- janobe interview management systemSourceCodester Interview Management System addCandidate.php sql injection5.3 Medium
- projectworlds online admission systemprojectworlds Online Admission System process_login.php sql injection6.9 Medium
tandemcrates.iotandem is unmaintainedNo scoretandem_garble_interopcrates.iotandem_garble_interop is unmaintainedNo scoretandem_http_servercrates.iotandem_http_server is unmaintainedNo scoretandem_http_clientcrates.iotandem_http_client is unmaintainedNo score- soplanningCross-Site Scripting (XSS) in SOPlanning5.1 Medium
- google cloud looker studioUnauthorized access through stored credentials in Looker Studio7.7 High
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- qdocs smart schoo, smart school +1 moreStored XSS in Smart School5.1 Medium
- google cloud looker studioSQL Injection in Looker Studio7.3 High
- google cloud looker studioSQL Injection in Looker Studio7.6 High
- google cloud lookerCommand Injection in Looker7.1 High
- jumo varitron300, varitron500, varitron500 touch +2 moreJumo: Insufficient entropy in PRNG may lead to root access7.4 High
- janobe baby care systemSourceCodester Baby Care System updatewelcome.php sql injection5.3 Medium
- janobe baby care systemSourceCodester Baby Care System admin.php sql injection5.1 Medium
- cloudinaryCloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand8.8 High
- code-projects food ordering systemSourceCodester Food Ordering System edit-orders.php sql injection5.3 Medium
- gnu libmicrohttpd, gnu project libbmicrohttpd +1 moreNULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The...8.7 High
- gnu libmicrohttpd, gnu project libbmicrohttpd +1 moreNULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The...8.7 High
- code-projects food ordering systemSourceCodester Food Ordering System view-ticket.php sql injection5.3 Medium
- oretnom23 survey application systemSourceCodester Survey Application System LoginRegistration.php update_user sql injection6.9 Medium
- cybertutor new site serverCyberTutor｜New Site Server - Use of Client-Side Authentication9.3 Critical
- hundred plus eip plusHundred Plus｜EIP Plus - Arbitrary File Uplaod8.6 High
- Show moreLoading…