CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- directusDirectus Vulnerable to Information Leakage in Existing Collections4.3 Medium
- directusDirectus Vulnerable to Stored Cross-site Scripting5.5 Medium
- go ssh, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 morePotential denial of service in golang.org/x/crypto/ssh/agent7.5 High
- directusDirectus has Improper Permission Handling on Deleted Fields4.6 Medium
- openobserveOpenObserve Vulnerable to HTML Injection in Organization Invitation Emails3.5 Low
- astroAstro development server error page vulnerable to reflected Cross-site Scripting2.7 Low
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets6.6 Medium
- socketdev firewall-releaseExternal Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw7.3 High
- vegaVega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable8.1 High
- typebot, baptistearno typebot.io +1 moreTypebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block9.6 Critical
- dell alienware command center 6.x (awcc), alienware command center +1 moreDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure...7.8 High
- dell alienware command center 6.x (awcc), alienware command center +1 moreDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control...3.3 Low
- qingdao esoft tianchuang network technology co., ltd. zentao biz, zentao max, zentao open source edition +2 moreZenTao Biz < 6.5, Max < 3.0, & Open Source Edition 16.5/16.5beta1 SQL Injection via user-login.html8.7 High
- dell alienware command center 6.x (awcc), alienware command center +1 moreDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access...6.6 Medium
- dell alienware command center 6.x (awcc), alienware command center +1 moreDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure...6.6 Medium
- dell alienware command centerDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of...7.8 High
- apple compressorThe issue was addressed by refusing external connections by default. This issue is fixed in...8.8 High
- amtt hotel broadband operation system, amttgroup hibos +1 moreAMTT Hotel Broadband Operation System get_firstdate.php sql injection5.3 Medium
gnutlsTuxCare,gnutls-c++TuxCare,gnutls-daneTuxCare +2 more +4 moreUpdate of gnutlsNo score- pamzey patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System api_patient_checkin.php getPatientAppointment sql injection6.9 Medium
- typebot, baptistearno typebot.io +1 moreTypebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure5.0 Medium
- hp 7kw48a firmware, 7kw49a firmware, 7kw50a firmware +65 more +67 moreCertain HP LaserJet Pro Printers – Potential Information Disclosure6.9 Medium
- hp 7kw48a firmware, 7kw49a firmware, 7kw50a firmware +65 more +67 moreCertain HP LaserJet Pro Printers – Potential Information Disclosure6.9 Medium
- mattermost, mattermost mobile +1 moreInadequate validation of SSO redirect credentials permits credential theft6.1 Medium
- mattermost, mattermost server +1 moreCross-team channel membership access3.1 Low
- keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 moreKeycloak-server: debug default bind address6.8 Medium
- cameasy liketeacameasy Liketea API Endpoint StoreController.php list sql injection6.9 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco Catalyst Center Privilege Escalation Vulnerability4.3 Medium
- cisco digital network architecture center (dna center)Cisco Catalyst Center Software HTTP Open Redirect Vulnerability4.7 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco Catalyst Center Cross-Site Scripting Vulnerability6.1 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center API Command Injection Vulnerability6.3 Medium
- cisco digital network architecture center (dna center)Cisco Catalyst Center Privilege Escalation Vulnerability8.8 High
- astroAstro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass6.5 Medium
- 1panel-dev maxkbMaxKB has Information Leak in sandbox6.3 Medium
- 1panel-dev maxkbMaxKB has SSRF in sandbox7.4 High
- mrubymruby array.c sort_cmp use after free4.8 Medium
- zitadelZITADEL vulnerable to Account Takeover with deactivated Instance IdP7.4 High
- privatebinPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal5.8 Medium
- zoom workplace, meeting software development kit +1 moreZoom Workplace Clients - Inefficient Regular Expression Complexity8.1 High
- zoom communications inc. clients, zoom meeting software development kit, rooms +3 more +5 moreZoom Clients - Improper Removal of Sensitive Information5.3 Medium
- fabian simple e-banking systemFabian Ros/SourceCodester Simple E-Banking System cross-site request forgery5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm paySuccess improper authorization5.3 Medium
- zoom communications workplace, zoom meeting software development kit, workplace desktop +2 moreZoom Workplace for Windows - Cross-site Scripting4.3 Medium
- zoom communications inc. workplace vdi plugin macos universal installer, zoom workplace virtual desktop infrastructure +1 moreZoom Workplace VDI Plugin macOS Universal Installer - Symlink Following6.6 Medium
- zoom communications inc. workplace clients, zoom meeting software development kit, workplace desktop +1 more +3 moreZoom Workplace Clients - Improper Certificate Validation4.8 Medium
- zoom workplace, zoom communications inc. workplace for android, zoom meeting software development kit +2 moreZoom Workplace for Android - Improper Authorization Handling8.1 High
- zoom communications inc. workplace vdi client, zoom workplace virtual desktop infrastructure +1 moreZoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature7.5 High
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall cancelOrder improper authorization5.3 Medium
- zoom communications inc. clients, zoom meeting software development kit, rooms +3 more +5 moreZoom Clients - External Control of File Name or Path4.3 Medium
- zoom communications inc. workplace for macos, zoom meeting software development kit, workplace desktop +2 moreZoom Workplace for macOS - External Control of File Name or Path5.0 Medium
- Show moreLoading…