CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- asus routerA path traversal vulnerability has been identified in certain router models. A remote,...6.9 Medium
- asus routerAn authentication bypass vulnerability has been identified in the IFTTT integration feature. A...7.5 High
- asus routerA command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker...7.5 High
- asus routerA SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker...5.9 Medium
- asus routerAn integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may...6.0 Medium
- asus routerA path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated...8.2 High
- bylancer bookme – free online appointment booking and scheduling pluginBookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter4.9 Medium
- sunarc refund request for woocommerceRefund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update4.3 Medium
- webgarh peer publishPeer Publish <= 1.0 - Cross-Site Request Forgery4.3 Medium
- ov3rkll projectlistProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter4.9 Medium
- sigalitam just highlightJust Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting4.4 Medium
- buywptemplates ace post type builderAce Post Type Builder <= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter5.3 Medium
- karthiksg inline frame – iframeInline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- nmedia frontend file manager pluginFrontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming4.3 Medium
- liquidthemes ai engine for wordpress: chatgpt, gpt content generatorAI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- docjojo atec duplicate page & postatec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure5.3 Medium
- mahabubs youtube subscribeYouTube Subscribe <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID4.4 Medium
- lyrathemes social images widgetSocial Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion5.3 Medium
- appglut locker contentLocker Content <= 1.0.0 - Unauthenticated Information Exposure5.3 Medium
- nmedia admin and customer messages after order for woocommerce: orderconvoAdmin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure5.3 Medium
- ov3rkll projectlistProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload7.2 High
- themehunk wishlist for woocommerceWishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation6.5 Medium
- nmedia admin and customer messages after order for woocommerce: orderconvoAdmin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages4.3 Medium
- evolurise conditionnal maintenance mode for wordpressConditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery4.3 Medium
- gwendydd chamber dashboard business directoryChamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export5.3 Medium
- bestweblayout job board by bestwebsoftJob Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage6.1 Medium
- vithanhlam zweb social mobile – ứng dụng nút gọi mobileZWeb - Social Mobile <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- autochat automatic conversationAutochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- asus routerA stack buffer overflow vulnerability has been identified in certain router models. An...6.9 Medium
- asus routerAn authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by...9.2 Critical
- intercom, inc. security point (windows) of malion, security point (windows) of malioncloud +1 moreSecurity Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow...9.3 Critical
- intercom, inc. security point (windows) of malion, security point (windows) of malioncloud +1 moreSecurity Point (Windows) of MaLion and MaLionCloud contains a stack-based buffer overflow...9.3 Critical
- intercom, inc. security point (windows) of malionIncorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3...4.8 Medium
- google cloud lookerRemote Code Execution in Looker via Teradata JDBC Driver7.5 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreMongoDB may be susceptible to Invariant Failure due to batched delete7.1 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreMongoDB Server may allow queries to be terminated by unauthorized users2.3 Low
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreImproper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server2.3 Low
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreTime-series operations may cause internal BSON size limit to be exceed7.1 High
- venusweb edukart proEduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalation9.8 Critical
- milmor telegram bot & channelTelegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username7.2 High
- pr-gateway blog2social: social media auto post & schedulerBlog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing5.4 Medium
- sony corporation snc-cx600w, sony snc-cx600w firmware +1 moreCross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is...4.8 Medium
- sony corporation snc-cx600w, sony snc-cx600w firmware +1 moreCross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a...2.1 Low
- fuji television network, inc. "fod" app for android, "fod" app for ios +1 more"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to...5.1 Medium
- quadlayers search excludeSearch Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API4.3 Medium
- sneeit frameworkSneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback9.8 Critical
- asus myasusA local privilege escalation vulnerability exists in the restore mechanism of ASUS System...8.5 High
- mescuwa entropy-derbyInside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage8.7 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authentication in lunary-ai/lunary9.3 Critical
- red hat cert manager support for red hat openshift release 1.18, ceph storage 8, discovery 2 +11 more +13 moreGnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function4.0 Medium
- Show moreLoading…