CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- wazuhWazuh NULL pointer dereference in fim_alert line 6665.1 Medium
- wazuhWazuh installation fails to protected authd.pass on Windows1.8 Low
- jzeuzs thread-amountthread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS8.7 High
- wazuhWazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities7.7 High
- authzed spicedbSpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results2.9 Low
- ml-explore mlxMLX has Wild Pointer Dereference in load_gguf()5.5 Medium
- ml-explore mlxMLX has heap-buffer-overflow in load()5.5 Medium
- the browser company of new york diaDia: Increased Spoof Risk; Missing full screen toast7.4 High
- wazuh wazuh-dashboard-pluginsWazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint5.3 Medium
- ribose rnpRNP 0.18.0 Vulnerable PKESK session keys7.7 High
- tainacanTainacan <= 1.0.0 - Unauthenticated Information Exposure5.3 Medium
- oc3dots s2b ai assistant – chatbot, ai agents, chatgpt api, image generatorS2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload7.2 High
- hashicorp terraform provider, tooling +1 moreVault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method7.4 High
- grafana, grafana enterprise +1 moreIncorrect privilege assignment10.0 Critical
- hashicorp terraform, terraform enterprise +1 moreTerraform Enterprise state versions can be created by users with specific permissions without sufficient write access4.3 Medium
- unknown mstoreapp mobile app, mstoreapp mobile multivendor +1 moreMstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation9.8 Critical
- matrixaddons easy invoiceWordPress Easy Invoice plugin <= 2.1.4 - Local File Inclusion vulnerability6.6 Medium
- theme funda show variations as single products woocommerceWordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability5.3 Medium
- themeatelier better chat support for messengerWordPress Better Chat Support for Messenger plugin <= 1.2.18 - Broken Access Control vulnerability5.3 Medium
- webtoffee accessibility toolkit by webyesWordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability4.3 Medium
- nelio software popupsWordPress Nelio Popups plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins tiktok feedWordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability5.3 Medium
- octolize cart weight for woocommerceWordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability5.3 Medium
- merlot digital (by tnc) tnc toolbox: web performanceWordPress TNC Toolbox: Web Performance plugin <= 2.0.4 - Broken Access Control vulnerability4.3 Medium
- scott paterson subscriptions & memberships for paypalWordPress Subscriptions & Memberships for PayPal plugin <= 1.1.7 - Broken Access Control vulnerability5.3 Medium
- essential plugin featured post creativeWordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability4.3 Medium
- sabuj kundu cbx bookmark & favoriteWordPress CBX Bookmark & Favorite plugin <= 2.0.1 - Broken Access Control vulnerability4.3 Medium
- themeatelier chat helpWordPress Chat Help plugin <= 3.1.3 - Broken Access Control vulnerability5.3 Medium
- camille v travelers' mapWordPress Travelers' Map plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- igor jerosimić i order termsWordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- imtiaz rayhan table block by tablebergWordPress Table Block by Tableberg plugin <= 0.6.9 - Broken Access Control vulnerability4.3 Medium
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.13 - SQL Injection vulnerability8.5 High
- hupe13 extensions for leaflet mapWordPress Extensions for Leaflet Map plugin <= 4.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bqworks accordion sliderWordPress Accordion Slider plugin <= 1.9.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- design stylish cost calculatorWordPress Stylish Cost Calculator plugin <= 8.1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sonalsinha21 skt skill barWordPress SKT Skill Bar plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webtoffee product feed for woocommerceWordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability4.3 Medium
- property hive propertyhiveWordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability4.3 Medium
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability5.3 Medium
- tyche softwares arconix shortcodesWordPress Arconix Shortcodes plugin <= 2.1.18 - Broken Access Control vulnerability4.3 Medium
- shahjahan jewel fluentcommunityWordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerability4.3 Medium
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability5.3 Medium
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability5.3 Medium
- jeff starr head meta dataWordPress Head Meta Data plugin <= 20250327 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- jegstudio gutenverse formWordPress Gutenverse Form plugin <= 2.2.0 - Broken Access Control vulnerability6.5 Medium
- wpwax legal pagesWordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability5.3 Medium
- wp legal pages cookie notice for gdpr, ccpa & eprivacy consentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability4.3 Medium
- cozmoslabs wp webhooksWordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability7.2 High
- stiofan userswpWordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability5.3 Medium
- tychesoftwares custom order numbers for woocommerceWordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…