CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- gallagher t21 readerMissing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an...2.4 Low
- gallagher high sec end of line moduleIncorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High...5.7 Medium
- gallagher hbus devicesObservable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical...5.7 Medium
- zyxel dx3300-t0 firmware, ax7501-b0 firmware, ax7501-b1 firmware +51 more +53 moreA post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0...8.8 High
- zyxel dx3301-t0 firmware, ax7501-b0 firmware, ax7501-b1 firmware +63 more +65 moreAn uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware...5.3 Medium
- canvaThe Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without...3.2 Low
kimageformatsOSS-FuzzUse-of-uninitialized-value in QImage::pixelNo score- code-projects student information systemitsourcecode Student Information System enrollment_edit1.php sql injection5.3 Medium
- carmelo simple pizza ordering systemcode-projects Simple Pizza Ordering System listorder.php sql injection6.9 Medium
- agronholm cbor2cbor2 C extension decoder flaws can cause denial of service7.5 High
- phpgurukul student record systemA Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of...7.5 High
- remyandrade student grades management systemA vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected...6.8 Medium
- bhabishya-123 e-commerceA DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E...5.4 Medium
- eprosima fast ddseProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow...7.5 High
- backdropcms backdrop cmsBackdrop CMS Host Header Injection vulnerability6.1 Medium
- opensourcepos open source point of saleThe password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account...7.5 High
- pnetlabpnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter.6.5 Medium
- dzzofficeDzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php...9.8 Critical
- dzzofficeDzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.9.8 Critical
- dzzofficeThe comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks...5.4 Medium
- baryhuang aws resources mcp serverA code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that...6.5 Medium
- mcp server for data exploration project server for data explorationA command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp...6.5 Medium
- awesomeminer awesome minerA vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write...7.3 High
- kishan0725 hospital management systemkishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in appsearch...6.1 Medium
- kishan0725 hospital management systemkishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR)...6.5 Medium
- kishan0725 hospital management systemkishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php,...6.5 Medium
- ispyconnect agent dvrLocal Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an...7.8 High
- No product listedA remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers...6.5 Medium
- dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware, mozart dds next 2000 firmware +19 more +21 moreThe Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a...5.4 Medium
- dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware, mozart dds next 2000 firmware +19 more +21 moreThe Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an...9.8 Critical
- dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware, mozart dds next 2000 firmware +19 more +21 moreThe Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an...7.2 High
- sencore decoder-ccv2 firmware, en2sdi-2hd firmware, smp100 firmware +2 moreThe Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is...5.7 Medium
- eurolab-srl elts 100 firmwareThe Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access...9.8 Critical
- itel id mux firmwareThe Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper...9.8 Critical
- itel idgateway firmwareThe Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to...10.0 Critical
- sound4 impact firmwareThe Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via...7.2 High
- modular maxModular Max Serve has Unsafe Deserialization vulnerability8.4 High
- requarks wiki.jsRequarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user...9.1 Critical
- cinnamon kotaemonPlaintext password storage in Kotaemon 0.11.0 in the client's localStorage.7.5 High
- cinnamon kotaemonCross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute...6.1 Medium
- metacubex mihomoIncorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level...6.5 Medium
- openml frontendThe openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and…7.5 High
- ascertia signinghubIn Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password...9.8 Critical
- ascertia signinghubIn Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user...4.3 Medium
- d-link dir-822k, dir-825m, dwr-m920 +5 more +7 moreD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection5.3 Medium
- google chromeType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to...8.8 High
- google chrome, chromium v8, siemens cadra +2 moreType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to...8.8 High
- d-link dir-822k, dir-825m, dwr-m920 +7 more +9 moreD-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflow8.7 High
- dell controlvault3, controlvault3 plus, broadcom bcm5820x +2 moreDell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability8.7 High
- dell controlvault3, controlvault3 plus, broadcom bcm5820x +2 moreDell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation vulnerability8.7 High
- Show moreLoading…