CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- s-itoc mruby\/cmrubyc alloc.c mrbc_raw_realloc null pointer dereference4.8 Medium
- carmelogarcia courier management systemcode-projects Courier Management System add-office.php sql injection5.3 Medium
- saysis computer systems trade ltd. co. starcitiesReflected XSS in Saysis's StarCities5.4 Medium
- shopside software technologies inc. shopsideiFrame Injection in Mikrogrup's Shopside4.7 Medium
- automated logic webctrl, carrier i-vu +1 moreALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter5.4 Medium
- automated logic webctrl, carrier i-vu +1 moreALC WebCTRL Carrier i-Vu Open Redirect via URL parameter8.6 High
- vivotek affected device model numbers are fd7131-vvtk,fd7131-vvtk,fd7131-vvtk,fd7141-vvtk,ip7131-vvtk,ip7133-vvtk,ip7133-vvtk,ip7133-vvtk,ip7134-vvtk,ip7135-vvtk,ip7135-vvtk,ip7135-vvtk,ip7135-vvtk,ip7137-vvtk,ip7137-vvtk,ip7137-vvtk,ip7137-vvtk,ip7137-vvtk,ip7137-vvtk,ip7138-vvtk,ip7142-vvtk,ip7142-vvtk,ip7151-vvtk,ip7152-vvtk,ip7153-vvtk,ip7153-vvtk,ip7154-vvtk,ip7330-vvtk,ip7330-vvtk,ip7330-vvtk,ip8131-vvtk,ip8131-vvtk,ip8131-vvtk,ip8131w-vvtk,pt7135-vvtk,pt7137-tcon,pt7137-vvtk,pt7137-vvtk,pt7137-vvtk,pt7137-vvtk,pz7131-vvtk,pz7131-vvtk,pz71x1-vvtk,pz71x1-vvtk,pz71x2-vvtk,sd73x3-vvtk,sd73x3-vvtk,sd73x3-vvtk,tc5330-vvtk,tc5332-tcvv,tc5333-tcvv,tc5633-tcvv,tc5633-vvtk,vs7100-vvtk,vs7100-vvtk,vs7100-vvtkUse of default login credentials in Legacy Vivotek Devices9.3 Critical
- eksagate electronic engineering and computer industry trade inc. webpack management systemSQLi in Exagate's Webpack Management System9.8 Critical
- codehub666 94listcodehub666 94list function.php login sql injection6.9 Medium
- apache causewayApache Causeway: Java deserialization vulnerability to authenticated attackers6.3 Medium
- google cloud lookerRemote Code Execution in Looker due to Improperly Validated Directory Deletion7.1 High
- fortinet fortiadcA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in...4.2 Medium
python-acmeopenSUSE,python-certbotopenSUSE,python-certbot-nginxopenSUSE +3 more +5 moreSecurity update for certbotNo score- upkeeper managerInsertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper...7.3 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'7.2 High
- codesnippetspro code snippetsCode Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains8.0 High
- smub giveaways and contests by rafflepress – get more website traffic, email subscribers, and social followersGiveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting7.2 High
- shelly pro 4pmAllocation of Resources Without Limits or Throttling in Shelly Pro 4PM8.3 High
- shelly pro 3emOut-of-bounds Read in Shelly Pro 3EM8.3 High
- softaculous siteseo – seo simplifiedSiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure4.3 Medium
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution5.3 Medium
- unknown waveplayerWavePlayer < 3.8.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- cyberlord92 wp login and register using jwtWP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure4.3 Medium
- softaculous siteseo – seo simplifiedSiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset5.3 Medium
- dfactory responsive lightbox & galleryResponsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery5.4 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update6.5 Medium
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import7.2 High
- amans2k funnelkit – funnel builder for woocommerce checkoutFunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode6.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- jackdewey community eventsCommunity Events <= 1.5.4 - Unauthenticated SQL Injection7.5 High
- elextensions wschat – wordpress live chatWSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset4.3 Medium
- kwmanagement pet-manager – petfinderPet-Manager – Petfinder <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcode6.4 Medium
- timeslotplugins time slot – booking and appointment systemBooking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending5.3 Medium
- ays pro quiz makerQuiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure5.3 Medium
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpressEmail Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger5.3 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- saad iqbal new user approveNew User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling5.3 Medium
- yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename5.3 Medium
- yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion5.3 Medium
- asustor abp and aesWindows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privileges9.3 Critical
- tanium tanosTanium addressed an arbitrary file deletion vulnerability in TanOS.5.6 Medium
- nec corporation rakurakumusen start exDLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a...8.4 High
- dlink dir-868l firmwareD-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution...7.3 High
- learnwithfair php-ecommerce-projectA reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E...6.1 Medium
- hackerwhale restaurant website restoranGithub Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability...6.5 Medium
- campcodes online hospital management systemCampcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index...7.3 High
- onecommanderMilos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal. The vulnerability...7.5 High
- pixeon weblaudosA reflected cross-site scripting (XSS) vulnerability exists in the password change functionality...4.6 Medium
- itel idenc firmwareThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper...10.0 Critical
- axeltechnology streamermax mk ii firmwareThe Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable...9.8 Critical
- Show moreLoading…