CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- simple sa wirtualna uczelniaRCE in Wirtualna Uczelnia9.3 Critical
- unitecms unlimited elements for elementor, unlimited elements for elementor (premium) +1 moreUnlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload7.2 High
- sdmc ne6037Authenticated RCE in SDMC NE6037 router9.3 Critical
- galdub folders – unlimited folders to organize media library folder, pages, posts, file managerFolders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation4.3 Medium
pnpmopenSUSESecurity update for pnpmNo score- apache skywalkingApache SkyWalking: Stored XSS vulnerability6.1 Medium
- apache cloudstackApache CloudStack: Potential remote code execution on Javascript engine defined rules4.7 Medium
- apache cloudstackApache CloudStack: Lack of user permission validation leading to data leak for few APIs4.3 Medium
- pretixLimited HTML injection in emails2.4 Low
- emrevona wp fastest cache – wordpress cache pluginWP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions4.3 Medium
- eaton galileo softwareImproper input sanitization in the file archives upload functionality of Eaton Galileo software...7.3 High
- ays-pro ai chatbot with chatgpt and content generator by aysAI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads5.3 Medium
- shapedplugin quick view for woocommerceQuick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure5.3 Medium
- ays-pro ai chatbot with chatgpt and content generator by aysAI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter6.5 Medium
- open-xchange gmbh ox app suiteMalicious content uploaded as file can be used to execute script code when following attacker...5.4 Medium
- open-xchange gmbh ox app suiteMalicious e-mail content can be used to execute script code. Unintended actions can be executed...6.1 Medium
- open-xchange gmbh ox app suiteMalicious content at office documents can be used to inject script code when editing a document....5.4 Medium
- open-xchange gmbh ox app suiteMalicious content uploaded as file can be used to execute script code when following attacker...5.4 Medium
- blubrry powerpress podcasting plugin by blubrryBlubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'8.8 High
- qodeinteractive qode wishlist for woocommerceQODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update5.3 Medium
- themesupport hide category by user role for woocommerceHide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing5.3 Medium
- assafp quiz, poll & survey maker by opinion stagePoll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection4.3 Medium
- wpdirectorykit wp directory kitWP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter6.1 Medium
- era404 stafflistStaffList <= 3.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- trustindex customer reviews collector for woocommerceCustomer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting6.1 Medium
- validator project validatorValidator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements8.7 High
- qode interactive tiare membershipTiare Membership <= 1.2 - Unauthenticated Privilege Escalation9.8 Critical
- elated themes findall membershipFindAll Membership <= 1.0.4 - Authentication Bypass via Social Login9.8 Critical
- directorythemes tigerTiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- directorythemes tigerTiger <= 101.2.1 - Unauthenticated Privilege Escalation9.8 Critical
- presstigers simple folioSimple Folio <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- sonalsinha21 skt paypal for woocommerceSKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment Bypass7.5 High
- elated themes findall listingFindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation9.8 Critical
- mitsubishi electric corporation gx works2Information Disclosure Vulnerability in GX Works25.5 Medium
- cyberark secure web sessions extensionClient-Side Denial of Service Condition in SWS Extension prior to version 2.2.303054.8 Medium
- wpoets soundslidesSoundslides <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode6.4 Medium
- realin wp-twitpicwp-twitpic <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sscovil sorttable postSortTable Post <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- gungorbudak shoutyShouty <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shouty Shortcode Attributes6.4 Medium
- reuters news agency direct, rnags reuters direct +1 moreReuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset5.3 Medium
- oscaruh google drive upload and download linkGoogle Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- reuters news agency direct, rnags reuters direct +1 moreReuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset4.3 Medium
- zte elasticnet ume r32Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing...7.5 High
- automated logic webctrl, carrier i-vu +1 moreALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting6.9 Medium
- automated logic webctrl, carrier i-vu +1 moreALC WebCTRL Carrier i-Vu Access Control Bypass9.2 Critical
- automated logic gen5 controllers, webctrl, carrier i-vu +2 moreALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range8.8 High
- automated logic zone controllersAutomated Logic and Carrier Zone Controllers malformed packets denial of service8.7 High
- tryton trytondtrytond does not enforce access rights for data export6.5 Medium
- tryton trytondtrytond does not enforce access rights for the route of the HTML editor.7.1 High
- tryton trytondtrytond allows remote attackers to obtain sensitive trace-back (server setup) information4.3 Medium
- Show moreLoading…