CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- iqonicdesign wpbookitWPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting7.2 High
- itvn9online echbay admin securityEchBay Admin Security <= 1.3.0 - Reflected Cross-Site Scripting6.1 Medium
- farvehandleren custom post typeCustom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion4.3 Medium
- darto islamic phrasesIslamic Phrases <= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jcollings import wp – export and import csv and xml files to wordpressImport WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure5.3 Medium
- billybigpotatoes brighttalk wordpress shortcodeBrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fpcorso tips shortcodeTips Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bww url image importerURL Image Importer <= 1.0.6 - Authenticated (Author+) Arbitrary File Upload8.8 High
- davidangel audiotubeAudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bandido checkboxCheckbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing5.3 Medium
- wpswings return refund and exchange for woocommerceReturn Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation4.3 Medium
- developdaly stock toolsStock Tools <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- husainali52 wp audio galleryWP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter8.1 High
- qzzr pollcaster shortcode pluginPollcaster Shortcode Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- tainacanTainacan <= 1.0.0 - Reflected Cross-Site Scripting6.1 Medium
- coffeebite padlet shortcodePadlet Shortcode <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- logstare inc. installer of logstare collector (for windows), secuavail logstare collector +1 moreUncontrolled search path element issue exists in the installer of LogStare Collector (for Windows...8.4 High
- secuavail logstare collector, logstare inc. collector (for linux), collector (for windows) +2 moreLogStare Collector improperly handles the password hash data. An administrative user may obtain...6.9 Medium
- secuavail logstare collector, logstare inc. collector (for linux), collector (for windows) +2 moreCross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted...6.9 Medium
- secuavail logstare collector, logstare inc. collector (for linux), collector (for windows) +2 moreLogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If...5.3 Medium
- secuavail logstare collector, logstare inc. collector (for linux), collector (for windows) +2 moreLogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If...4.8 Medium
- secuavail logstare collector, logstare inc. collector (for linux), collector (for windows) +2 moreThe installation directory of LogStare Collector is configured with incorrect access permissions....6.8 Medium
- wiresharkAccess of Uninitialized Pointer in Wireshark7.8 High
- gitlabMissing Authorization in GitLab5.0 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion4.3 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore4.3 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty4.3 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore4.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure5.3 Medium
- seiko epson corporation epson web control for seiko epson projector products, epson webconfig for seiko epson projector products +1 moreEPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict...9.3 Critical
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statementNo score- admerc file management system, itsourcecode online file management system +1 moreitsourcecode Online File Management System ajax.php sql injection6.9 Medium
- openfga, openfga helm charts +1 moreOpenFGA Improper Policy Enforcement5.8 Medium
- campcodes complete online beauty parlor management system, online beauty parlor management system +1 moreCampcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting4.8 Medium
- microsoft visual studio codeGitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability8.0 High
- microsoft 365 defender portalMicrosoft Defender Portal Spoofing Vulnerability8.3 High
- microsoft azure monitor, azure monitor control service +1 moreAzure Monitor Elevation of Privilege Vulnerability8.6 High
- microsoft azure bastion developerAzure Bastion Elevation of Privilege Vulnerability10.0 Critical
- microsoft dynamics omnichannel sdk storage containersDynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint onlineMicrosoft SharePoint Online Elevation of Privilege Vulnerability9.8 Critical
- ibm webmethods integrationIBM webMethods Integration Deserialization8.8 High
- mindersec minderMinder does not sandbox http.send in Rego programs8.5 High
- opto22 groov rio grv-r7-i1vapm-3, groov rio grv-r7-mm1001-10, groov rio grv-r7-mm2001-10 +2 more +4 moreCommand Injection in Opto22 Groov REST API7.5 High
- workos authkit-nextjsauthkit-nextjs may let session cookies be cached in CDNs8.0 High
- anthropic claude code, anthropics claude-code +1 more@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes8.7 High
- vllmvLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`6.5 Medium
- vllmvLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs8.3 High
- ibm concertIBM Concert Cross-Site Scripting6.1 Medium
- ibm concertIBM Concert Information Disclosure5.1 Medium
- ibm concertIBM Concert Improper Log Neutralization6.2 Medium
- Show moreLoading…