CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- logpoint siemAn issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System...6.9 Medium
- logpoint siemAn issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy...6.9 Medium
- logpoint siemAn issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of...8.5 High
- spotipy-dev spotipySpotipy has a XSS vulnerability in OAuth callback server3.6 Low
- oisf suricataSuricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer7.5 High
- oisf suricataSuricata is vulnerable to a heap buffer overflow on verdict7.5 High
- oisf suricataSuricata is vulnerable to a stack overflow on large file transfers with http-body-printable7.5 High
- oisf suricataSuricata is vulnerable to a stack overflow on larger compressed data7.5 High
- oisf suricataSuricata is vulnerable to a stack overflow from big content-type7.5 High
- oisf suricataSuricata is vulnerable to a null deref when used with base64_data7.5 High
- oisf suricataSuricata is vulnerable to unbounded memory growth for decompression7.5 High
- timlegge xml::sig, xml\ \ +1 moreXML-Sig prior to 0.68 for Perl improperly validates XML without signatures9.3 Critical
- angular, siemens ruggedcom rst2428p, sidis prime +2 moreAngular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs7.7 High
- tellion, inc. hn-2204ap routerTellion HN-2204AP Unauthenticated Configuration Disclosure8.7 High
- escam qd-900 wifi hd cameraESCAM QD-900 Unauthenticated Configuration Disclosure8.7 High
- dongyoung media tech co., ltd. dm-ap240t/w wireless access pointDongyoung Media DM-AP240T/W Unauthenticated Configuration Disclosure8.7 High
- bacnet interoperability test services, inc. test serverBACnet Test Server 1.01 Malformed BVLC Length DoS8.7 High
- astak cm-818t3 2.4ghz wireless security surveillance cameraAstak CM-818T3 Unauthenticated Configuration Disclosure8.7 High
- ace security wip-90113 hd cameraACE SECURITY WIP-90113 Unauthenticated Configuration Disclosure8.7 High
- better-authbetter-auth before 1.4.0 Session Revocation via Forged Cookie2.0 Low
- dontkry willitmergewillitmerge has a command Injection vulnerability6.9 Medium
- digitalbazaar forgenode-forge ASN.1 Unbounded Recursion8.7 High
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAuthentication Bypass by Spoofing in GitLab6.5 Medium
- gitlabInsertion of Sensitive Information into Log File in GitLab2.0 Low
- anyscale rayRay is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack9.4 Critical
- red hat openstack platform 13 (queens), openstack platform 16.2, openstack platform 17.1 +2 morePython-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature6.5 Medium
- hackerbay oneuptimeOneUptime Unauthorized User Creation via API8.8 High
- splunk add-on for palo alto networksSensitive Information Disclosure in “_internal“ index through Splunk Add-On for Palo Alto Networks2.7 Low
- zenitel tciv-3+Zenitel TCIV-3+ Cross-site Scripting9.3 Critical
- zenitel tciv-3+Zenitel TCIV-3+ Out-of-bounds Write7.0 High
- zenitel tciv-3+Zenitel TCIV-3+ OS Command Injection10.0 Critical
- zenitel tciv-3+Zenitel TCIV-3+ OS Command Injection10.0 Critical
- zenitel tciv-3+Zenitel TCIV-3+ OS Command Injection10.0 Critical
- frappe crmFrappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller7.1 High
- opto 22 groov view server, grv-epic-pr1 firmware, grv-epic-pr2 firmware +2 moreOpto 22 groov View Exposure of Sensitive Information Through Metadata6.1 Medium
- tianocore edk2UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu3.7 Low
- cursorImproper neutralization of special elements used in an OS command ('command injection') in Cursor...9.8 Critical
- gnome glib, red hat ceph storage 8, discovery 2 +58 more +60 moreGlib: integer overflow in in g_escape_uri_string()7.7 High
- favethemes houzezHouzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload6.1 Medium
- favethemes houzezHouzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search6.3 Medium
- wiresharkAccess of Uninitialized Pointer in Wireshark5.5 Medium
- apache druidApache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.9.8 Critical
- apache hiveApache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs5.4 Medium
- asr lapwing linuxOut-of-bounds Read in nr flc7.4 High
- unknown tax service electronic hdmTax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution8.6 High
- zephyrproject-rtos zephyrBluetooth: Mesh: Out-of-Bound Write in gen_prov_cont7.6 High
- zephyrproject-rtos zephyrBluetooth: Mesh: Out-of-Bound Write in gen_prov_start7.6 High
- Show moreLoading…