CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- google chromeInappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58...4.3 Medium
- google chromeInappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a...6.3 Medium
- google chromeInappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a...4.3 Medium
- otacke snordian's h5pxapikatchuSNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_data7.2 High
- magicbug cloudlogAn authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The...5.4 Medium
- oretnom23 simple online book store systemInformation Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store...7.5 High
- cksource ckfinderCKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An...6.1 Medium
- radare radare2A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the...5.5 Medium
- radare radare2A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the...4.3 Medium
- radioinorr svx portalReflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to...6.1 Medium
- radioinorr svx portalSQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin...6.0 Medium
- advantech tp 3250 firmwareA heap corruption vulnerability exists in the Advantech TP-3250 printer driver's...6.8 Medium
- nero backitupNero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22)...8.6 High
- alteryx serverWhen processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object...5.4 Medium
- desktopalert pingalert application serverA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11...4.3 Medium
- desktopalert pingalert application serverAn Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert...4.3 Medium
- desktopalert pingalert application serverA Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert...3.8 Low
- desktopalert pingalert application serverAn issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1...3.7 Low
- desktopalert pingalert application serverA Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop...6.5 Medium
- desktopalert pingalert application serverA Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of...7.6 High
- desktopalert pingalert application serverAn issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1...7.5 High
- desktopalert pingalert application serverAn Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert...9.6 Critical
- desktopalert pingalert application serverA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11...3.3 Low
- desktopalert pingalert application serverA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11...4.1 Medium
- desktopalert pingalert application serverAn Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert...10.0 Critical
- phpgurukul student record systemPHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and...6.5 Medium
- phpgurukul student record systemPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course...6.5 Medium
- phpgurukul student record systemPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3,...6.5 Medium
- phpgurukul student record systemPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and...6.5 Medium
- phpgurukul student record systemPHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname...6.1 Medium
- phpgurukul student record systemPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword...6.5 Medium
- phpgurukul student record systemPHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid...6.5 Medium
- phpgurukul student record systemMultiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to...6.5 Medium
- altocms alto cmsCross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute...6.1 Medium
kernelTuxCare,kernel-abi-stablelistsTuxCare,kernel-coreTuxCare +54 more +56 moreUpdate of kernelNo score- apollographql federation@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields7.5 High
github.com/canonical/lxdGoLXD vulnerable to a local privilege escalation through custom storage volumes8.6 Highgithub.com/filebrowser/filebrowserGo,github.com/filebrowser/filebrowser/v2Go +1 moreFile Browser has risk of HTTP Request/Response smuggling through vulnerable dependency9.1 Criticalaws-advanced-nodejs-wrappernpmAWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance8.0 Highgithub.com/aws/aws-advanced-go-wrapper/auth-helpersGo,github.com/aws/aws-advanced-go-wrapper/aws-secrets-managerGo,github.com/aws/aws-advanced-go-wrapper/awssqlGo +7 more +9 moreAWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance8.0 Highsoftware.amazon.jdbc:aws-advanced-jdbc-wrapperMavenAmazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance8.0 High- sonarrSonarr Service Sonarr.Console.exe default permission8.5 High
- No product listedRadarr Service Radarr.Console.exe default permission8.5 High
- ibm aix, vios +1 moreAIX Path Traversal8.2 High
- ibm aix, vios +1 moreAIX Code Execution10.0 Critical
- ibm aix, vios +1 moreAIX Insufficiently Protected Credentials9.0 Critical
- ibm aix, vios +1 moreAIX Command Execution9.6 Critical
- jitsi jitsi-meetJitsi Meet has DOM Redirect on Microsoft OAuth Flow2.7 Low
- getgrist grist-coregrist-core has insufficient access control in endpoints for comparisons between documents and versions5.3 Medium
- getgrist grist-coregrist-core has path to server-side requests via websocket6.8 Medium
- Show moreLoading…