CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- apache kvrocksApache Kvrocks: RESET command grants admin privileges5.4 Medium
- keras-team keras-team/kerasPath Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()8.0 High
rustls-pemfilecrates.iorustls-pemfile is unmaintainedNo scoremaxminddbcrates.iomaxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe1.0 Low- abb terra ac wallboxStack Memory Corruption Vulnerability6.9 Medium
- uniong webitrUniong｜WebITR - Arbitrary File Read7.1 High
- uniong webitrUniong｜WebITR - SQL Injection7.1 High
- uniong webitrUniong｜WebITR - SQL Injection7.1 High
- uniong webitrUniong｜WebITR - Authorization Bypass7.7 High
- nextendweb nextend social login and registerNextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login4.3 Medium
- huawei harmonyosPermission control vulnerability in the file management module. Impact: Successful exploitation...4.9 Medium
- huawei emui, harmonyos +1 moreUAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability...5.8 Medium
- huawei harmonyosVulnerability of improper criterion security check in the call module. Impact: Successful...7.3 High
- huawei harmonyosIdentity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation...6.2 Medium
- huawei harmonyosPermission control vulnerability in the file management module. Impact: Successful exploitation...4.9 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the Settings module. Impact: Successful exploitation of this...8.4 High
- huawei harmonyosPermission control vulnerability in the print module. Impact: Successful exploitation of this...6.2 Medium
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of...5.3 Medium
- huawei harmonyosPermission control vulnerability in the Notepad module. Impact: Successful exploitation of this...5.1 Medium
- huawei harmonyosPermission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this...5.5 Medium
- huawei emui, harmonyos +1 moreVulnerability of accessing invalid memory in the component driver module. Impact: Successful...6.6 Medium
- huawei harmonyosPermission control vulnerability in the App Lock module. Impact: Successful exploitation of this...5.1 Medium
- huawei harmonyosPermission control vulnerability in the distributed component. Impact: Successful exploitation of...8.0 High
- huawei harmonyosPermission control vulnerability in the startup recovery module. Impact: Successful exploitation...6.8 Medium
- huawei harmonyosUAF vulnerability in the screen recording framework module. Impact: Successful exploitation of...6.4 Medium
- huawei harmonyosDoS vulnerability in the video-related system service module. Impact: Successful exploitation of...7.3 High
- huawei harmonyosUAF vulnerability in the screen recording framework module. Impact: Successful exploitation of...8.4 High
- huawei harmonyosConfiguration defect vulnerability in the file management module. Impact: Successful exploitation...4.4 Medium
- huawei harmonyosPermission control vulnerability in the memory management module. Impact: Successful exploitation...9.3 Critical
- mispapp/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site...4.1 Medium
- cerebrate-project cerebrateUsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to...9.4 Critical
- mispapp/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for...8.2 High
- libexpat project libexpat, siemens ruggedcom rst2428p, simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of...2.9 Low
- mustangproject mustangMustangproject allows exfiltrating files via XXE attacks2.8 Low
- iteras peppol-pyPeppol-py is vulnerable to XXE attacks due to Saxon configuration5.0 Medium
- kivitendoKivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD...5.0 Medium
- salt project saltSalt Master authentication protocol downgrade may enable minion impersonation7.5 High
- salt project saltSalt junos module uses an unsafe YAML loader which may allow unintended code execution7.3 High
- hcltech unicaFile upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.6.3 Medium
- hcltech unicaCSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.7.5 High
- hcltech unicaCross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.5.4 Medium
- hcltech unicaCross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.5.5 Medium
- mattermost, mattermost server +1 moreAccount Takeover via Code Exchange Endpoint9.9 Critical
- mattermost, mattermost server +1 moreInformation Disclosure in Common Teams API4.3 Medium
- mattermost, mattermost server +1 moreAccount takeover on OAuth/OpenID-enabled servers9.9 Critical
- devolutions serverExposure of credentials in unintended requests in Devolutions Server.This issue affects Server:...3.5 Low
- devolutions serverSQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects...8.8 High
- devolutions serverExposure of email service credentials to users without administrative rights in Devolutions...4.3 Medium
- openprinting cupsOpenPrinting CUPS vulnerable to stack based out-of-bound write6.0 Medium
- openprinting cupsOpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack5.1 Medium
- Show moreLoading…