CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- fortinet fortiwebA use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all...4.8 Medium
- fortinet fortipamA Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet...3.8 Low
- fortinet forticlient, forticlientwindows +1 moreAn active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3,...4.9 Medium
- fortinet fortiadcAn exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC...3.9 Low
- fortinet fortiextender, fortiextender firmware +1 moreA buffer copy without checking size of input ('classic buffer overflow') in Fortinet...6.3 Medium
- fortinet fortiextender, fortiextender firmware +1 moreA debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0...5.2 Medium
- fortinet fortimailAn improper neutralization of crlf sequences ('crlf injection') in Fortinet FortiMail 7.6.0...3.9 Low
- fortinet forticlient, forticlientwindows +1 moreA Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7.4.0 through...7.1 High
- fortinet fortivoiceAn improper neutralization of special elements used in an SQL Command ("SQL Injection")...7.7 High
- fortinet fortiwebAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...6.7 Medium
- fortinet forticlient, forticlientwindows +1 moreAn Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet...7.1 High
- nvidia isaac-gr00t n1.5NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an...7.8 High
- nvidia isaac-gr00t n1.5NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an...7.8 High
- infocert gosign, tinexta infocert s.p.a. gosign desktop +1 moreGoSign Desktop < 2.4.1 Insecure Update Mechanism RCE7.0 High
- pluginsglpi databaseinventorypluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests4.3 Medium
- times software e-payrollImproper neutralization of input in Times Software E-PAYROLL5.3 Medium
- mattermost, mattermost server +1 moreChannel member objects leak read status3.0 Low
- eclipse jerseyRace Condition allows Bypass of Trust Restrictions9.4 Critical
- checkmkInsufficient permission validation on multiple REST API endpoints5.3 Medium
- checkmkInsufficient permission validation when configuring notification parameters5.3 Medium
- checkmkOverly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output4.8 Medium
- rsyncRsync: Out of bounds array access via negative index4.3 Medium
- remyandrade student grades management systemSourceCodester Student Grades Management System Add New Grade grades.php cross site scripting5.1 Medium
- facebook whatsapp business for ios, whatsapp for ios, whatsapp +2 more +4 moreIncomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73,...5.4 Medium
- alekv pixel manager for woocommerce – conversion tracking, google ads, ga4, tiktok, dynamic remarketingPixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure5.3 Medium
- bplugins icon list block – add icon-based lists with custom stylesIcon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
- jcd windu cms, windu cms +1 moreUser enumeration in Windu CMS6.9 Medium
- jcd windu cms, windu cms +1 moreBroken Access Control in Windu CMS6.9 Medium
- jcd windu cms, windu cms +1 moreMultiple Stored XSS in Windu CMS4.8 Medium
- jcd windu cms, windu cms +1 moreStored XSS in Windu CMS5.3 Medium
- jcd windu cms, windu cms +1 moreCross-Site Request Forgery in Windu CMS5.1 Medium
- jcd windu cms, windu cms +1 moreBruteforce Protection Bypass in Windu CMS6.9 Medium
- jcd windu cms, windu cms +1 moreCross-Site Request Forgery in Windu CMS5.1 Medium
- jcd windu cms, windu cms +1 moreCross-Site Request Forgery in Windu CMS6.8 Medium
- oretnom23 train station ticketing systemSourceCodester Train Station Ticketing System ajax.php sql injection5.3 Medium
- oretnom23 train station ticketing systemSourceCodester Train Station Ticketing System ajax.php sql injection5.3 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery6.8 Medium
- wso2 api manager, api control plane, identity server +7 more +9 moreImproper Certificate-Based Authentication Enforcement in Multiple WSO2 Products9.8 Critical
- oretnom23 train station ticketing systemSourceCodester Train Station Ticketing System ajax.php sql injection5.3 Medium
- oretnom23 train station ticketing systemSourceCodester Train Station Ticketing System ajax.php sql injection6.9 Medium
- janobe interview management systemSourceCodester Interview Management System editQuestion.php cross site scripting5.1 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services8.8 High
- iest winplusStored Cross-Site Scripting (XSS) in WinPlus by Informática del Este5.1 Medium
- iest winplusStored Cross-Site Scripting (XSS) in WinPlus by Informática del Este5.1 Medium
- iest winplusStored Cross-Site Scripting (XSS) in WinPlus by Informática del Este8.7 High
- iest winplusStored Cross-Site Scripting (XSS) in WinPlus by Informática del Este8.7 High
- wpengine wp migrate lite – migration made easyWP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery5.8 Medium
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 moreImproper access control via php endpoint7.5 High
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 morePossible arbitrary code execution8.8 High
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 morePossible arbitrary file upload8.8 High
- Show moreLoading…