CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- linuxscsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod7.8 High
- linuxmisc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()7.8 High
- linuxusb: host: max3421-hcd: Fix error pointer dereference in probe cleanupNo score
- linuxscsi: mpt3sas: Fix crash in transport port remove by using ioc_info()5.5 Medium
- linuxremoteproc: qcom: pas: Shutdown lite ADSP DTB on X1ENo score
- linuxsparc: fix accurate exception reporting in copy_{from_to}_user for Niagara7.8 High
- elastic kibanaKibana Origin Validation Error4.3 Medium
- algosec firewall analyzerPath Traversal Allows Remote Code Execution in AlgoSec Firewall Analyzer7.3 High
- apache ofbizApache OFBiz: Reflected Cross-site Scripting6.5 Medium
- apache ofbizApache OFBiz: Critical Remote Command Execution via Unrestricted File Upload7.3 High
- divvydrive information technologies inc. digital corporate warehouseStored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse7.3 High
- apache openofficeApache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variables5.3 Medium
- apache openofficeApache OpenOffice: Possible memory corruption during CSV import4.3 Medium
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via DDE function7.5 High
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via background and bullet images7.5 High
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc8.1 High
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via OLE objects6.5 Medium
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via IFrame7.5 High
- mrclayton payment plugins braintree for woocommercePayment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud7.5 High
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure4.3 Medium
- aenrich a+hcm, a+hrd +1 moreaEnrich｜eHRD - Stored Cross-Site Scripting5.1 Medium
- aenrich a+hrd, a\+hrd +1 moreaEnrich｜a+HRD - Authentication Abuse9.3 Critical
- aenrich a+hrd, a\+hrd +1 moreaEnrich｜eHRD - Authentication Abuse9.3 Critical
- aenrich a+hrd, a\+hrd +1 moreaEnrich｜eHRD - Stored Cross-Site Scripting4.8 Medium
- webtoffee alt text generator ai – auto generate & bulk update alt texts for imagesAlt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion4.3 Medium
- sourcefound membershipworks – membership, events & directoryMembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- stellarwp bookit — booking & appointment calendarBooking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection7.5 High
- unknown team members showcaseTeam Members Showcase < 3.5.0 - Reflected XSS7.1 High
- asgaros forumAsgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update4.3 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment4.3 Medium
- acowebs wishlist and save for later for woocommerceWishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion4.3 Medium
- zscaler client connectorHealth check port on ZCC allows tunnel bypass5.2 Medium
- linuxdrm/vmwgfx: Fix Use-after-free in validation7.8 High
- linuxdrm/vmwgfx: Fix a null-ptr access in the cursor snooper6.8 Medium
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in...4.0 Medium
- fujitsu / fsas technologies irmcFujitsu iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is...7.5 High
- fujitsu fbiosdrv.sysFujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system...8.2 High
- openprinting cups-filters, libcupsfilters +1 more[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster4.0 Medium
- centralsquare community developmentAn Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to...9.8 Critical
- centralsquare community developmentA SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to...9.8 Critical
- airpig2011 iec104A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07...7.5 High
- airpig2011 iec104A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08)....4.0 Medium
- dvsekhvalnov jose2gojose2go is vulnerable to a JWT bomb attack through its decode function7.5 High
- free5gcfree5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an...7.5 High
- asecam ip camera firmwareIncorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10...7.5 High
- tenda ac15 firmwareTenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password...9.8 Critical
- ph7builder ph7 social dating builderA stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17...5.4 Medium
- crushftpCross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a...6.1 Medium
- linuxfoundation pytorchAn issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch...3.3 Low
- fiberhome hg6145f1 firmwareA vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi...9.8 Critical
- Show moreLoading…