CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- code-projects email logging interfacecode-projects Email Logging Interface signup.cpp path traversal4.8 Medium
- No product listedDouPHP file.class.php unrestricted upload5.1 Medium
- gitlabMemory Allocation with Excessive Size Value in GitLab3.5 Low
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab4.3 Medium
- gitlabImproper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab3.5 Low
- gitlabMissing Authorization in GitLab5.3 Medium
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabImproper Handling of URL Encoding (Hex Encoding) in GitLab3.1 Low
- d-link dir-816l, dlink dir-816l firmware +1 moreD-Link DIR-816L soap.cgi soapcgi_main stack-based overflow8.7 High
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.0.2 - Missing Authorization5.3 Medium
- d-link dir-816l, dlink dir-816l firmware +1 moreD-Link DIR-816L __ajax_exporer.sgi scandir_main stack-based overflow8.7 High
- d-link dir-816l, dlink dir-816l firmware +1 moreD-Link DIR-816L gena.cgi genacgi_main stack-based overflow8.7 High
- wpchill modula image gallery – photo grid & video galleryImage Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move4.3 Medium
- wedevs project manager – ai powered project management, task management, kanban board & time trackerWP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'6.5 Medium
- smub all in one seo – powerful seo plugin to boost seo rankings & increase trafficAll in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion4.3 Medium
- qode qi blocksQi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize4.3 Medium
vlcOSS-FuzzHeap-buffer-overflow in DecodeFrameNo score- aveva application serverAVEVA Application Server IDE Basic Cross-site Scripting7.2 High
- aveva edgeAVEVA Edge Use of a Broken or Risky Cryptographic Algorithm8.3 High
- brightpick ai mission control / internal logic controlBrightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials6.0 Medium
- brightpick ai mission control / internal logic controlBrightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials7.1 High
- brightpick ai mission control / internal logic controlBrightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function7.1 High
- general industrial controls lynx+ gatewayGeneral Industrial Controls Lynx+ Gateway Cleartext Transmission of Sensitive Information8.7 High
- general industrial controls lynx+ gatewayGeneral Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function8.7 High
- general industrial controls lynx+ gatewayGeneral Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function9.2 Critical
- general industrial controls lynx+ gatewayGeneral Industrial Controls Lynx+ Gateway Weak Password Requirements8.8 High
- denver sho-110Denver SHO-110 IP Camera Unauthenticated Snapshot Access8.7 High
- ipcop project ipcopIPCop <= 2.1.9 Authenticated RCE8.7 High
- netis systems co., ltd. dl4322dNetis DL4322D RTK 2.1.1 FTP Service DoS8.7 High
- planex communications inc. cs-qp50f-ing2PLANEX CS-QP50F-ING2 Smart Camera Remote Configuration Disclosure8.7 High
- positive technologies maxpatrol 8 (server), xspider (server) +1 morePositive Technologies MaxPatrol 8 & XSpider Remote DoS8.7 High
- request serious play llc serious play, serious play pro +1 moreReQuest Serious Play F3 Media Server <= 7.0.3 Remote DoS8.7 High
- db elettronica telecomunicazioni spa screen sft dab 600/c, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure6.9 Medium
- tg8 firewallTG8 Firewall Unauthenticated RCE via runphpcmd.php9.3 Critical
- tg8 firewallTG8 Firewall Unauthenticated User Password Disclosure8.7 High
- ubee interactive evw3226Ubee EVW3226 Unauthenticated Backup File Disclosure8.7 High
- vodacom vodafone h500sVodafone H500s WiFi Password Disclosure via activation.json8.7 High
- d-link dir-816l, dlink dir-816l firmware +1 moreD-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflow9.3 Critical
- intelbras icip, icip 30 firmware +1 moreIntelbras ICIP acessodeusuario.xml credentials storage6.9 Medium
- astrbotAstrBot is vulnerable to RCE with hard-coded JWT signing keys7.3 High
@apollo/compositionnpm,@rootio/apollo__compositionRoot +1 moreApollo Federation has Improper Enforcement of Access Control on Transitive Fields7.5 High- bdtask isshue, isshue multi store ecommerce shopping cart solution +1 moreBdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting4.8 Medium
nodemailerRoot,@rootio/nodemailerRoot +1 moreDuplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict7.5 High- bdtask news365Bdtask/CodeCanyon News365 profile unrestricted upload5.1 Medium
- flowiseFlowise - Unverified Password Change via Account Settings8.7 High
- flowiseFlowise - Unverified Email Change via Account Profile Endpoint8.7 High
- flowiseFlowise - Session Invalidation Failure After Password Change8.6 High
shopware/corePackagistShopware 6's password recovery link does not expire after email change5.0 Medium- Show moreLoading…