CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- No product listedInsecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to...8.8 High
- ncp-e secure enterprise client, ncp secure entry client +1 moreNCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted...9.8 Critical
- redaxoREDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]6.1 Medium
- humhub cfilesCFiles Unauthorized Folder/ZIP Access in Public Spaces5.4 Medium
- intercore-productions core-botCore Bot is Leaking Sensitive Credentials in Logs, Errors, and Messages8.8 High
- nanomqNanoMQ UAF of retain message due to invalid MQTTV5 properties6.0 Medium
- hackerbay oneuptimeOneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation6.9 Medium
- iidk-the-actual consoleConsole is vulnerable to path traversal regarding custom assets8.7 High
- soportecibeles ai feedsAI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload9.8 Critical
- soportecibeles cibeles aiCIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload9.8 Critical
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreWebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode5.1 Medium
- owasp java html sanitizer, java-html-sanitizer +1 moreOWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization8.6 High
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreWebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction4.7 Medium
- better-auth passkeybetter-auth passkey before 1.4.0 IDOR via delete-passkey7.1 High
- victoriametricsVictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM2.7 Low
- fugue-project fugueFugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer8.8 High
- amazon opensearchOpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS8.3 High
- digital bazaar forge, node-forge +1 moreCVE-2025-128168.6 High
- geoserverGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature8.2 High
- contaoContao is vulnerable to cross-site scripting in templates3.3 Low
- synergetic data systems, inc. unform serverUnForm Server < 10.1.15 Doc Flow Unauthenticated File Read8.7 High
- contaoContao is vulnerable to remote code execution in template closures6.6 Medium
- geoserverGeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format6.1 Medium
- nvidia nemo agent toolkitNVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an...7.6 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could...7.3 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components,...7.8 High
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a...2.3 Low
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...3.2 Low
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a...3.3 Low
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a...4.3 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a...4.4 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...4.4 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...5.7 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...5.7 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...5.7 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause...5.7 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an...6.7 Medium
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...7.8 High
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could...8.0 High
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged...9.3 Critical
- ashlar argon, cobalt, cobalt share +2 more +4 moreHeap-based Buffer Overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share8.4 High
- ashlar argon, cobalt, cobalt share +2 more +4 moreOut-of-bounds Write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share8.4 High
- sircom smart alert (sisaMissing Authentication for Critical Function in SiRcom SMART Alert (SiSA)8.8 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation5.5 Medium
- hashgraph guardian, nozomi networks cmc +1 moreStored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.05.8 Medium
- hcl software inotesHCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,8.1 High
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure3.7 Low
- anchore grypeGrype has a credential disclosure vulnerability in Grype JSON output8.2 High
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- the webkitgtk team webkitgtk, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreWebkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos7.5 High
- Show moreLoading…