CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- tryton saoTryton sao allows XSS because it does not escape completion values5.4 Medium
- phpgurukul online shopping portalInsecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping...4.3 Medium
- primakon project contract managementPrimakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered...5.3 Medium
- primakon project contract managementPrimakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access...8.6 High
- primakon project contract managementThe Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary...8.8 High
- primakon project contract managementPrimakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions...8.8 High
- primakon project contract managementPrimakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when...9.8 Critical
- primakon project contract managementThe Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but...8.8 High
- primakon project contract managementPrimakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due...4.3 Medium
- redaxoREDAXO CMS is vulnerable to RCE attack through its template management component7.2 High
- redaxoREDAXO CMS is vulnerable to XSS through its module management component4.8 Medium
- ruckuswireless ruckus unleashedA reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the...6.1 Medium
- syrotech sy-gpon-1110-wdont firmwareAn issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers...9.0 Critical
- sigb pmbAn issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute...9.8 Critical
- sigb pmbSIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the ...6.5 Medium
- ilevia eve x1 server firmwareCross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18...9.6 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory...9.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /material...9.8 Critical
- interviewx echoAn issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an...7.5 High
- libpngLIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`7.1 High
- libpngLIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication7.1 High
- libpngLIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images6.1 Medium
- libpngLIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index6.1 Medium
omero-webPyPIOMERO.web uses jquery-form library, which may be vulnerable to XSS attack1.3 Lowgithub.com/babylonlabs-io/babylonGo,github.com/babylonlabs-io/babylon/v2Go,github.com/babylonlabs-io/babylon/v3Go +1 more +3 moreBabylon's BIP322 signature implementation is not fully compliant to the spec6.9 Mediumgithub.com/babylonlabs-io/babylonGo,github.com/babylonlabs-io/babylon/v2Go,github.com/babylonlabs-io/babylon/v3Go +1 more +3 moreBabylon's malformed vote extensions are not rejected7.0 Highgithub.com/lf-edge/ekuiperGo,github.com/lf-edge/ekuiper/v2Go +1 moreLF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction9.3 Critical- py-pdf pypdfpypdf manipulated LZWDecode streams can exhaust RAM6.6 Medium
- quadlayers perfect brands for woocommercePerfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection6.5 Medium
- formwork project formworkFormwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags6.5 Medium
- getsentry sentry-javascriptSentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`5.1 Medium
- openbaoOpenBao Privileged Operator Identity Group Root Escalation7.5 High
- amd uprof, μprof +1 moreImproper input validation within AMD uProf can allow a local attacker to write out of bounds,...5.5 Medium
- amd uprof, μprof +1 moreImproper input validation within AMD uprof can allow a local attacker to write to an arbitrary...5.5 Medium
- amd uprof, μprof +1 moreImproper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially...7.1 High
- amd xilinx run time (xrt)Improper input validation within the XOCL driver may allow a local attacker to generate an...8.0 High
- amd xilinx run time (xrt)Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use...7.3 High
- amd xilinx run time (xrt)Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate...5.7 Medium
- beijing star-net ruijie network technology co., ltd. nbr series routersRuijie Networks NBR Routers Unauthenticated Arbitrary File Upload via fileupload.php9.3 Critical
- shenzhen tvt digital technology co., ltd. nvms-9000TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure8.7 High
- shenzhen tvt digital technology co., ltd. nvms-9000TVT NVMS-9000 Hard-coded API Credentials & Command Injection9.3 Critical
- ibm concertIBM Concert Information Disclosure5.9 Medium
- quantumnous new-apiQuantumNous New API Has SSRF Bypass8.5 High
- amd xilinx run time (xrt)Improper input validation within the XOCL driver may allow a local attacker to generate an...7.3 High
- amd xilinx run time (xrt)A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt...7.3 High
- body-parserbody-parser vulnerable to denial of service when url encoding is used5.5 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure5.3 Medium
- Show moreLoading…