CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- h3blogpojoin h3blog addtitle cross site scripting5.1 Medium
- h3blogpojoin h3blog add cross site scripting5.1 Medium
- bdtask wholesale, wholesale inventory control and inventory management system +1 moreBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scripting5.1 Medium
- bdtask wholesale, wholesale inventory control and inventory management system +1 moreBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgery5.3 Medium
- bdtask saleserpBdtask/CodeCanyon SalesERP User Profile edit_profile cross site scripting5.1 Medium
- bdtask saleserpBdtask/CodeCanyon SalesERP cross-site request forgery5.3 Medium
- rachelos werss we-mp-rssrachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery5.3 Medium
- code-projects gym management systemCodeAstro Gym Management System view-member-report.php sql injection5.3 Medium
- palo alto networks prisma browserPrisma Browser: Sensitive Information Disclosure Vulnerability in Prisma Browser4.4 Medium
- palo alto networks prisma browserPrisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser1.1 Low
- palo alto networks prisma browserPrisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser1.1 Low
- zzcmsZZCMS wangkan_list.php sql injection5.3 Medium
- silentmatt expr-eval, javascript expression evaluator +1 moreCVE-2025-132049.8 Critical
- code-projects simple online hotel reservation systemcode-projects Simple Online Hotel Reservation System edit_account.php sql injection6.9 Medium
- arista networks eosOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.5.6 Medium
- fortinet fortiwebA relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0...9.4 Critical
- code-projects simple online hotel reservation systemcode-projects Simple Online Hotel Reservation System add_query_reserve.php sql injection6.9 Medium
- uryury-erp ury pos_extend.py overrided_past_order_list sql injection5.3 Medium
cabal-installHackagecabal-install dependency confusionNo scorespacecookieHackageBroken Path Sanitization in spacecookie LibraryNo scorecryptonHackage,cryptoniteHackage +1 moreDouble Public Key Signing Function Oracle Attack on Ed25519No scoreghcGHCSubword division operations may produce incorrect resultsNo scoreghcGHCSign extension error in the PPC64le FFINo scoreghcGHCSign extension error in the AArch64 NCGNo scorebaseHackagefromIntegral: conversion errorNo scoreketerHackageReflected XSS vulnerability in keterNo scorecabal-installHackagecabal-install uses expired key policiesNo scoregit-annexHackagegit-annex checksum exposure to encrypted special remotesNo scorebaseHackage,toml-readerHackage +1 morereadFloat: memory exhaustion with large exponentNo scorex509-validationHackagex509-validation does not enforce pathLenConstraintNo score- usememos memosMemos Access Tokens Stay Valid after User Password Change7.1 High
- floragunn search guard flxUnauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documents6.0 Medium
- rockwell automation arena® simulation, rockwellautomation arena +1 moreRockwell Automation Arena® Simulation Stack-Based Buffer Overflow Vulnerability7.1 High
- opensolution quickcms, quick.cms +1 moreMultiple Stored XSS in QuickCMS4.8 Medium
- opensolution quick.cms, quickcms +1 moreHard-coded admin credentials in Quick.CMS6.9 Medium
- optimus software brokerage automation2FA Expiry Bypass in Optimus Software's Brokerage Automation8.1 High
- jdsofttech school management system – wpschoolpressSchool Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL Injection4.9 Medium
- mattermost, mattermost server +1 morePassword hash and MFA secret returned in user email verification endpoint4.9 Medium
python-DjangoopenSUSESecurity update for python-DjangoNo score- mattermost, mattermost server +1 moreMS Teams plugin OAuth allows editing arbitrary posts5.4 Medium
- mattermost, mattermost server +1 moreLack of MFA enforcement in WebSocket connections6.5 Medium
- mattermost, mattermost server +1 moreUnauthorized access to archived channel content via threads interface3.1 Low
- mattermost, mattermost server +1 moreGuest user can discover archived public channels4.3 Medium
- unknown creta testimonial showcaseCreta Testimonial Showcase < 1.2.4 - Editor+ Local File Inclusion7.2 High
- sony network communications inc. ncp-hg100/cellular model, ncp-hg100/wlan model +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.6 High
- iq service international iq-supportIQ Service International｜IQ-Support - Arbitrary File Read8.7 High
- iq service international iq-supportIQ Service International｜IQ-Support - Exposure of Sensitive Information6.9 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60...4.3 Medium
- google chromeUse after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote...7.5 High
- google chromeInappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998...4.3 Medium
- Show moreLoading…