CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization...8.8 High
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of...6.7 Medium
- extplorersoerennb eXtplorer Filename cross site scripting5.1 Medium
- lenovo scanner proAn arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an...7.7 High
- lenovo scanner proA vulnerability was reported in the Lenovo Scanner pro application during an internal security...6.0 Medium
- lenovo app store, browser, legion zone +1 more +3 moreA potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser...7.7 High
- lenovo app storeAn improper permissions vulnerability was reported in Lenovo App Store that could allow a local...7.0 High
- lenovo dock managerAn improper default permission vulnerability was reported in Lenovo Dock Manager that, under...5.2 Medium
- enalean tuleapTuleap missing CSRF protection in the management of SVN commit rules and immutable tags4.6 Medium
- ibm openpagesIBM OpenPages Information Disclosure4.3 Medium
- openidentityplatform openamOpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info8.1 High
- datadog datadog-agentDatadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions7.0 High
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-0065.9 Medium
- campcodes school fees payment management systemCampcodes School Fees Payment Management System ajax.php sql injection5.3 Medium
- minttyZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability5.3 Medium
- omnissa workspace one uemOmnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious...5.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreRisky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise3.5 Low
- splunk, splunk cloud platform, enterprise +2 moreOpen Redirect on Web Login endpoint in Splunk Enterprise3.1 Low
- google chromeInappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote...8.8 High
- rhobs observability-operator, red hat cluster observability operator 1.3.1 +1 moreObservability-operator: observability operator privilege escalation8.8 High
- autodesk 3ds maxDWG File Parsing Use-After-Free Vulnerability7.8 High
- autodesk 3ds maxJPG File Parsing Out-of-Bounds Write Vulnerability7.8 High
- golemiq 0 day analyticsWordPress 0 Day Analytics plugin <= 4.0.0 - SQL Injection vulnerability7.6 High
- n-able n-centralN-central windows software probe Remote Code Execution10.0 Critical
- n-able n-centralN-central Authentication bypass via path traversal9.4 Critical
- n-able n-centralN-central Multiple XXE Injection Vulnerabilities8.4 High
- n-able n-centralN-central unauthenticated sessionID generation6.9 Medium
- schneider electric powerchute™ serial shutdownCWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system...7.3 High
- schneider electric powerchute™ serial shutdownCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...6.9 Medium
- schneider electric powerchute™ serial shutdownCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')...7.3 High
- suse opensuseA Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation...5.3 Medium
- typo3 extension "modules"Broken Authentication in extension “Modules” (modules)8.2 High
- yudiz easy email subscriptionEasy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting7.2 High
- giuse specific content for mobile – customize the mobile version without redirectionsSpecific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL Injection6.5 Medium
- linuxaccel/qaic: Fix bootlog initialization orderingNo score
- linuxtls: wait for pending async decryptions if tls_strp_msg_hold fails9.8 Critical
- linuxidpf: cleanup remaining SKBs in PTP flowsNo score
- linuxx86/mm: Fix SMP ordering in switch_mm_irqs_off()7.8 High
- linuxnet/ip6_tunnel: Prevent perpetual tunnel growth7.8 High
- linuxaccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()7.8 High
- linuxnvmet-fc: move lsop put work to nvmet_fc_ls_req_op7.5 High
- linuxnet: use dst_dev_rcu() in sk_setup_caps()7.8 High
- linuxbpf: Reject negative offsets for ALU ops7.8 High
- linuxsmc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().8.1 High
- cephRGW DoS attack with empty HTTP header in S3 object copy7.5 High
- linuxnet/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add8.8 High
- linuxnet/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()9.8 Critical
- linuxcan: j1939: prevent deadlock by moving j1939_sk_errqueue()5.7 Medium
- linuxinotify: Avoid reporting event with invalid wd0.0 None
- linuxsmc: Fix use-after-free in tcp_write_timer_handler().7.8 High
- Show moreLoading…