CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- amd kria™ som, zynq™ ultrascale+™ mpsocs, zynq™ ultrascale+™ rfsocs +2 moreThe security state of the calling processor into Arm® Trusted Firmware (TF-A) is not used and...8.6 High
- sourcecodester company website cmsSourceCodester Company Website CMS reset-password.php sql injection6.9 Medium
- campcodes online polling systemCampcodes Online Polling System registeracc.php sql injection6.9 Medium
- amd storemi™Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege...7.3 High
- amd storemi™A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege...7.3 High
- campcodes online polling systemCampcodes Online Polling System checklogin.php sql injection6.9 Medium
- campcodes school file management systemCampcodes School File Management System Login index.php sql injection6.9 Medium
- campcodes supplier management systemCampcodes Supplier Management System Login index.php sql injection6.9 Medium
- d-link dwr-m920, dlink dwr-m920 firmware +1 moreD-Link DWR-M920 formPinManageSetup sub_41C7FC buffer overflow8.7 High
- d-link dir-822k, dwr-m920, dlink dir-822k firmware +1 more +3 moreD-Link DIR-822K/DWR-M920 formWlEncrypt buffer overflow8.7 High
- d-link dir-822k, dwr-m920, dlink dir-822k firmware +1 more +3 moreD-Link DIR-822K/DWR-M920 formWanConfigSetup buffer overflow8.7 High
- d-link dir-822k, dwr-m920, dlink dir-822k firmware +1 more +3 moreD-Link DIR-822K/DWR-M920 formVpnConfigSetup buffer overflow8.7 High
- d-link dir-822k, dlink dir-822k firmware +1 moreD-Link DIR-822K formNtp sub_455524 buffer overflow8.7 High
- d-link dir-822k, dwr-m920, dlink dir-822k firmware +1 more +3 moreD-Link DIR-822K/DWR-M920 formFirewallAdv buffer overflow8.7 High
- d-link dir-822k, dwr-m920, dlink dir-822k firmware +1 more +3 moreD-Link DIR-822K/DWR-M920 formDdns memory corruption8.7 High
- ashraf-kabir travel-agencyashraf-kabir travel-agency Search results.php sql injection5.3 Medium
- ashraf-kabir travel-agencyashraf-kabir travel-agency index.php sql injection5.1 Medium
- ashraf-kabir travel-agencyashraf-kabir travel-agency customer_register.php unrestricted upload5.3 Medium
kimageformatsOSS-FuzzUse-of-uninitialized-value in comp_func_SourceOver_avx2No score- walterpinem oneclick chat to orderOneClick Chat to Order <= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure7.5 High
- codepeople booking calendar contact formBooking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter5.3 Medium
- westerndeal gsheetconnector for ninja formsGSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure4.3 Medium
- faysal61 idonate – blood donation, request and donor management system, themeatelier idonate +1 moreIDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion5.3 Medium
- codepeople cp contact form with paypalCP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation7.5 High
- scott paterson subscriptions & memberships for paypalSubscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation5.3 Medium
- codepeople appointment booking calendarAppointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter5.3 Medium
- humanityco cookie notice & compliance for gdpr / ccpaCookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
mosquittoOSS-FuzzHeap-use-after-free in password_file__cleanupNo score- wolfsslTLS 1.2 Client Can Downgrade Digest Used2.3 Low
- wolfsslTiming Side-Channel in PSK Binder Verification2.3 Low
- wolfsslInteger Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt2.1 Low
- wolfsslConstant Time Issue with Xtensa-based ESP32 and X225191.0 Low
- wolfsslPotential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello6.3 Medium
- wofssl wolfsslDoS Vulnerability in wolfSSL TLS 1.3 CKS Extension2.3 Low
- wolfsslImproper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify2.1 Low
- roocode roo code, roocodeinc roo-code +1 moreRoo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug8.1 High
- wolfsslForward Secrecy Violation in WolfSSL TLS 1.36.3 Medium
- langfuseLangfuse SSO Account Takeover via CSRF or phishing attack6.5 Medium
- pjsip pjprojectPJSIP is vulnerable to buffer overflow in Opus PLC8.7 High
- espressif esp-idfESP32-P4 JPEG Decoder Header Parsing Vulnerability6.9 Medium
- black duck scaBlack Duck SCA Project Privilege Escalation5.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreThe issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.7, iOS 18.5 and...2.4 Low
- apple macos, safari +1 moreA spoofing issue was addressed with improved truncation when displaying the fully qualified...4.3 Medium
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iPadOS...4.3 Medium
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- zozothemes zegen coreZegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- aws wickr, wickr enterprise, wickr gov +2 moreImproper resource release in the call termination process in AWS Wickr before version 6.62.13 on...6.8 Medium
- ibm concert, concert software +1 moreIBM Concert Software clickjacking6.3 Medium
- amd uprof, μprof +1 moreImproper input validation within AMD uprof can allow a local attacker to overwrite MSR registers,...5.5 Medium
- amd epyc™ 8004 series processors, epyc™ 9004 series processors, epyc™ 9005 series processors +5 more +7 moreA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest...5.3 Medium
- Show moreLoading…