CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- libcoapNULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3...4.3 Medium
- libcoapNULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3...4.3 Medium
- libcoapNULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3...4.3 Medium
- libcoapInteger signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5...7.5 High
- libcoapNULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl.c in OISM libcoap 4.3.5...7.5 High
- libcoapNULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to...7.5 High
- yccmsYCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management...6.1 Medium
- openrapid rapidcmsOpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.6.1 Medium
- millensys vision tools workspaceMILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (...9.8 Critical
- magewell ultra encode aio firmware, ultra encode hdmi firmware, ultra encode hdmi plus firmware +2 more +4 moreA Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro...6.5 Medium
- magewell pro convert 12g sdi 4k plus firmware, pro convert aes67 firmware, pro convert audio dx firmware +10 more +12 moreA Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro...5.7 Medium
- cinnamon kotaemonAn issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs...6.5 Medium
- blurams a31c firmwareAn issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers...6.8 Medium
- alinto sogo, debian linux +1 morealinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.6.1 Medium
- xtooltech xtool anyscanXtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical...4.3 Medium
- xtooltech xtool anyscanThe update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure...8.8 High
- xtooltech xtool anyscanXtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key...4.6 Medium
- xtooltech xtool anyscanXtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate...4.6 Medium
- craws openatlasA reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of...4.6 Medium
- craws openatlasA reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of...5.4 Medium
- craws openatlasAn issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute...8.1 High
- craws openatlasIncorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows...4.6 Medium
- free5gcNSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST7.5 High
- free5gcFree5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API6.5 Medium
- free5gcFree5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API6.5 Medium
- craws openatlasAn issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12...5.3 Medium
- ziragroup wbrmZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName.7.6 High
- tuya smartlife, tuya, tuya smart +2 moreCross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0...8.8 High
- desktopalert pingalert application serverAn Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert...7.5 High
- desktopalert pingalert application serverA Directory Traversal vulnerability was found in the Application Server of Desktop Alert...9.9 Critical
- desktopalert pingalert application serverA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11...5.3 Medium
- desktopalert pingalert application serverAn Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert...7.5 High
- academy software foundation openexrAcademy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- academy software foundation openexrAcademy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- academy software foundation openexrAcademy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- rsa authentication agent for windowsIn RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to...9.8 Critical
- projectworlds can pass malicious payloads, advanced library management system +1 moreprojectworlds can pass malicious payloads add_book.php unrestricted upload5.3 Medium
- projectworlds advanced library management systemprojectworlds Advanced Library Management System delete_admin.php sql injection6.9 Medium
- gn themes wp shortcodes plugin — shortcodes ultimateWP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery6.4 Medium
- code-projects simple food ordering system, fabian simple cafe ordering system +1 morecode-projects Simple Food Ordering System listorder.php sql injection5.3 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection5.3 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection5.3 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection5.3 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection5.3 Medium
- jarun nnnjarun nnn nnn.c run_cmd_as_plugin double free4.8 Medium
- code-projects inventory management systemSourceCodester Inventory Management System resetPassword.php password recovery6.9 Medium
- kimz190 pre-school management systemSourceCodester Pre-School Management System FilehelperController.php removefile denial of service5.3 Medium
- d-link dir-852, dlink dir-852 firmware +1 moreD-Link DIR-852 gena.cgi command injection6.9 Medium
- sourcecodester company website cmsSourceCodester Company Website CMS index.php sql injection6.9 Medium
- amd alveo™ v80 compute accelerator, versal™ ai core series, versal™ ai edge series +5 more +7 moreThe Secure Flag passed to Versal™ Adaptive SoC’s Arm® Trusted Firmware for Cortex®-A processors ...1.0 Low
- Show moreLoading…