CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- switchbot smart video doorbellSmart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code...8.6 High
- factionsecurity factionFACTION Unauthenticated Custom Extension Upload leads to RCE9.7 Critical
- caidoCaido Improperly Handles External Links in Markdown4.3 Medium
- open-circle valibotValibot has a ReDoS vulnerability in `EMOJI_REGEX`7.5 High
- drupal, webform multiple file upload project multiple file upload +1 moreXSS vulnerability when rendering filename in Webform Multiform7.0 High
- megatec taiwan upsilon2000v6.0Unquoted Service Path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEM7.1 High
- megatec taiwan upsilon2000v6.0Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege Escalation9.3 Critical
- megatec taiwan clientmateInsecure permissions in configuration directory (C:\\usr)6.9 Medium
- megatec taiwan clientmateUnquoted Service path in UPSilon2000V6.0 SYSTEM privilege service7.2 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Read via Null Byte Injection8.9 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreArbitrary File Overwrite via Tar Extraction Path Traversal9.3 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated OS Command Injection (restore_settings.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 morePostgreSQL SQL Injection (status_sql.php)7.2 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreAuthenticated Root Remote Code Execution through improper filtering of HTTP post request parameters9.3 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreStored Cross-Site Scripting via XML Injection7.1 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Deletion (patch_contents.php)9.2 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (patch_contents.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (upgrade_contents.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Deletion (upgrade_contents.php)7.8 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated OS Command Injection (start_upgrade.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreInfinite Loop Denial of Service via Failed File Deletion8.4 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Path Traversal with Arbitrary File Deletion7.7 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (status_contents.php)9.2 Critical
- microsoft azure application gateway, azure app gateway +1 moreAzure Application Gateway Elevation of Privilege Vulnerability9.8 Critical
- microsoft azure application gateway, azure app gateway +1 moreAzure Application Gateway Elevation of Privilege Vulnerability9.4 Critical
- kde connect protocolThe KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets....4.7 Medium
- edly tutorOverhang Tutor Discloses Sensitive Information due to Improper Cache-Control3.3 Low
- classroomioStored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated...5.4 Medium
- classroomioStored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated...5.4 Medium
- classroomioInsecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and...7.5 High
- classroomioAn Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access...4.3 Medium
- classroomioAn issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from...9.1 Critical
- komal97 grocerymartAn issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing...7.5 High
- henzljw hashtechAn unauthenticated administrative access vulnerability exists in the open-source HashTech project...9.8 Critical
- opencode ussd gatewayIncorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC...4.3 Medium
- opencode ussd gatewayIncorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway...6.5 Medium
- opencode ussd gatewayA reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release:...6.1 Medium
- opencode ussd gatewayOpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection...9.8 Critical
- opencode ussd gatewayOpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL...9.8 Critical
- trendnet tew-657brm firmwareTRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the...8.0 High
- tinyproxy project tinyproxyTinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port()...6.5 Medium
- ruoyiAn issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the...8.8 High
- youlai youlai-bootIncorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers...7.5 High
- youlai youlai-bootIncorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and...9.8 Critical
- kde skanpageIn KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the...3.2 Low
- monnit imonnitAn issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.9.8 Critical
- fastcom fac1200r firmwareFAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via...9.8 Critical
- fastcom fac1200r firmwareFAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via...9.8 Critical
- ruoyiRuoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope...7.5 High
- ruoyiRuoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope...7.5 High
- Show moreLoading…