CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- campcodes retro basketball shoes online storeCampcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting4.8 Medium
- progress moveit transferExternal Service Interaction (DNS)5.3 Medium
- campcodes retro basketball shoes online storeCampcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload5.1 Medium
- campcodes retro basketball shoes online storeCampcodes Retro Basketball Shoes Online Store receipt.php sql injection6.9 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreUnbounded memory consumption in golang.org/x/crypto/ssh5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 moreMalformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent5.3 Medium
- ibm iIBM i Information Disclosure6.5 Medium
- devcode-it openstamanagerOpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter8.8 High
- wbce cmsWBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)8.7 High
- ilbers isarSecurity Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is Set6.9 Medium
- homarrHomarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload8.1 High
- lynxtechnology twonky serverHard-coded encryption keys in Twonky Server8.2 High
- lynxtechnology twonky serverUnauthenticated log access in Twonky Server9.3 Critical
- lookylooLookyloo is vulnerable due to improper user input sanitization9.4 Critical
- anthropic claude code, anthropics claude-code +1 moreClaude Code vulnerable to command execution prior to startup trust dialog7.7 High
- esm esm.shesm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript6.1 Medium
- esm esm.shesm.sh CDN service has arbitrary file write via tarslip8.2 High
- lukevella ralllyRallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId8.1 High
- lukevella ralllyRallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation8.1 High
- lukevella ralllyRallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names6.5 Medium
- lukevella ralllyRallly Improper Authorization in Comment Endpoint Allows User Impersonation6.5 Medium
- lukevella ralllyRallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal7.1 High
- lukevella ralllyRallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants8.1 High
- lukevella ralllyRallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)9.1 Critical
- lukevella ralllyRallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)6.5 Medium
- lukevella ralllyRallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes6.5 Medium
- goauthentik authentikauthentik invitation expiry is delayed by at least 5 minutes5.8 Medium
- goauthentik authentikauthentik deactivated service accounts can authenticate to OAuth4.8 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 WrlExtraGet formWrlExtraGet buffer overflow8.7 High
- google cloud lookerSQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database6.0 Medium
- astroAstro middleware authentication checks based on url.pathname can be bypassed via url encoded values6.9 Medium
- astroAstro is vulnerable to Reflected XSS via the server islands feature7.1 High
- astroAstro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint5.4 Medium
- astroAstro Development Server is Vulnerable to Arbitrary Local File Read3.5 Low
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.php8.7 High
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE8.7 High
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE8.5 High
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php9.3 Critical
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.php8.7 High
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.php9.3 Critical
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.php6.9 Medium
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE8.5 High
- egovframework/egovframe-common-componentseGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints6.9 Medium
- egovframework/egovframe-common-componentseGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints8.7 High
- blackberry athoc, blackberry® athoc® (onprem) +1 moreInsecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc.5.0 Medium
- portabilis i-educari-Educar Authenticated Time-based SQL Injection in `agenda.php`7.2 High
- portabilis i-educari-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`7.2 High
- portabilis i-educari-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`7.2 High
- progress datadirect connect for jdbc autonomous rest connector, datadirect connect for jdbc for amazon redshift, datadirect connect for jdbc for apache cassandra +29 more +31 moreImproper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect...8.6 High
- progress datadirect connect for jdbc autonomous rest connector, datadirect connect for jdbc for amazon redshift, datadirect connect for jdbc for apache cassandra +29 more +31 moreImproper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect...8.6 High
- Show moreLoading…