CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- jobayer534 progress bar blocks for gutenbergProgress Bar Blocks for Gutenberg <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG5.4 Medium
- loveless randomquotrRandomQuotr <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting5.5 Medium
- iworks fleet managerFleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting4.4 Medium
- toastwebsites find unused imagesFind Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion5.3 Medium
- odude crypto toolCrypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion5.3 Medium
- mindstien my geo posts freeMy Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- oscaruribe ungapped widgetsUngapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- five9 live chatFive9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mitegvg slippy slider – responsive touch navigation sliderSlippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- eflyjason wp bbcodeWP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mvirik mementor coreMementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- shelfplanner shelf planner inventory management for woocommerceShelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files5.3 Medium
- virtus-designs wp bootstrap tabsWP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- shelfplanner shelf planner inventory management for woocommerceShelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- unisoc (shanghai) technologies co., ltd. sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t750/t765/t760/t770/t820/s8000/t8300/t9300In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to...5.1 Medium
- sap se commoncryptolibMemory Corruption vulnerability in SAP CommonCryptoLib7.5 High
- sap se s/4hana landscape (sap e-recruiting bsp)Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP)6.1 Medium
- sap se netweaver application server javaInformation Disclosure vulnerability in SAP NetWeaver Application Server Java5.3 Medium
- sap se s4core (manage journal entries)Missing Authorization check in SAP S4CORE (Manage Journal Entries)4.3 Medium
- sap se business one (sld)Information Disclosure vulnerability in SAP Business One (SLD)5.3 Medium
- sap se hana jdbc clientCode Injection vulnerability in SAP HANA JDBC Client6.9 Medium
- sap business connectorPath Traversal vulnerability in SAP Business Connector6.8 Medium
- sap business connectorOpen Redirect vulnerability in SAP Business Connector6.1 Medium
- sap business connectorOS Command Injection vulnerability in SAP Business Connector6.8 Medium
- sap se sql anywhere monitor (non-gui)Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)10.0 Critical
- sap se starter solution (pl saft)SQL Injection vulnerability in SAP Starter Solution (PL SAFT)5.4 Medium
- sap se gui for windowsInformation Disclosure vulnerability in SAP GUI for Windows5.5 Medium
- sap se solution managerCode Injection vulnerability in SAP Solution Manager9.9 Critical
- sap business connectorReflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector6.1 Medium
- sap se hana 2.0 (hdbrss)Missing authentication in SAP HANA 2.0 (hdbrss)5.8 Medium
- sap se netweaver enterprise portalJNDI Injection vulnerability in SAP NetWeaver Enterprise Portal6.5 Medium
- sap se netweaver application server for abap (migration workbench)Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench)2.7 Low
- sap se netweaver application server for abapMissing Authorization check in SAP NetWeaver Application Server for ABAP4.3 Medium
- trifectatechfoundation sudo-rssudo-rs doesn't record authenticating user properly in timestamp4.4 Medium
- trifectatechfoundation sudo-rssudo-rs: Partial password reveal is possible after timeout3.8 Low
- opswat outpost security suiteAn issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a...7.7 High
- github enterprise serverPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation7.5 High
- github enterprise serverDOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers8.6 High
- employee records system records system, skittles employee records system +1 moreEmployee Records System v1.0 Arbitrary File Upload RCE9.3 Critical
- rainbowfish software pacsone serverPacsOne Server 6.6.2 DICOM Web Viewer Directory Traversal LFI8.7 High
- authzed spicedbSpiceDB's WriteRelationships fails silently if payload is too big2.7 Low
- milvus-io milvusMilvus Proxy has Critical Authentication Bypass Vulnerability9.3 Critical
- langfuseLangfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs5.0 Medium
- bugsinkBugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)7.5 High
- bugsinkBugsink vulnerable to unauthenticated remote DoS via crafted Brotli input7.5 High
- parse-community parse-serverParse Server allows public `explain` queries which may expose sensitive database performance information and schema details6.9 Medium
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve is vulnerable to SSRF through its Webhooks9.1 Critical
- oauth2-proxyOAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation8.5 High
- torrentpierTorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter8.8 High
- academysoftwarefoundation openexrOpenEXR has use after free in PyObject_StealAttrString5.5 Medium
- Show moreLoading…