CVEs published in November 2026
3,455 vulnerabilities, 322 critical, 2 exploited.
- unknown userplace Userplace <= 1.2.0 - Unauthenticated Privilege Escalation No score
- unknown sync post with other site Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification No score
- unknown productive commerce Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers No score
- unknown ecommerce affiliate Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force No score
- unknown thanh toán quét mã qr code tự động BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation No score
- unknown razorpay for woocommerce Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook No score
- unknown razorpay for woocommerce Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route No score
- unknown razorpay for woocommerce Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply No score
- unknown backupwordpress BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error No score
- unknown turisbook booking system Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting No score
- unknown contact form 7 Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename No score
- unknown pie register Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification No score
- unknown pie register Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction No score
- unknown antom payments Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure No score
- unknown secure custom fields Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition No score
- unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields No score
- unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR No score
- unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path No score
- unknown fv flowplayer video player FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization No score
- unknown event tickets manager for woocommerce Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure No score
- unknown pronamic pay, pronamic pay doneren met mollie +1 more Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API No score
- unknown wp recipe maker WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure No score
- unrealircd The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label"... 8.6 High
- jihong88 suneditor SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder 5.3 Medium
- imgproxy imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader 8.7 High
- imgproxy imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader 8.7 High
- imgproxy imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow 9.3 Critical
- rustls Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass 6.9 Medium
- rustls rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure 4.6 Medium
- rustls rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello 6.3 Medium
- rustls rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression 6.3 Medium
- rustls Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug 4.1 Medium
- hickory-dns Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression 8.7 High
- hickory-dns Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service 8.7 High
- hickory-dns Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification 8.7 High
- hickory-dns Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name 8.7 High
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop 8.7 High
- hickory-dns Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass 6.9 Medium
- hickory-dns Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching 8.2 High
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery 8.3 High
- hickory-dns Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass 6.3 Medium
- hickory-dns Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records 6.3 Medium
- hickory-dns Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning 6.3 Medium
- hickory-dns Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors 6.3 Medium
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC 8.7 High
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3 8.7 High
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals 6.3 Medium
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors 6.3 Medium
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision 8.2 High
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks 8.2 High
- Show olderLoading…