CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- giteaGitea admin API public-only token scope bypass6.5 Medium
- giteaGitea Actions job token spoofing of instance-signed commits6.5 Medium
- giteaGitea archived repository release, milestone and label modification6.5 Medium
- giteaGitea public-only token bypass through Actions runner registration9.1 Critical
- giteaGitea contribution heatmap private activity disclosure to public-only tokens5.3 Medium
- giteaGitea stored XSS through legacy Actions artifact Content-Encoding5.4 Medium
- giteaGitea Actions task token private repository enumeration4.3 Medium
kdeconnectDebian,kdeconnect-kdeopenSUSE +1 morekdeconnect-kde-26.08.3-1.1 on GA mediaNo score- giteaGitea OAuth2 account auto-linking takeover through the sign-up form9.8 Critical
- giteaGitea Actions fork workflow trust through pull request review commit6.5 Medium
- typemillTypemill SvgSanitizer.php saveImage cross site scripting5.1 Medium
- delgan loguruDelgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos5.3 Medium
- unknown mappressMapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure5.3 Medium
- david lingren media library assistantMedia Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute6.8 Medium
- david lingren media library assistantMedia Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields4.3 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing4.3 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure4.3 Medium
- wavlink wl-wn530be1-aWAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection10.0 Critical
- wavlink wl-wn530hg4bWAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection9.4 Critical
- wavlink wn579x3-dWAVLINK WN579X3-D wapi.cgi port_forward os command injection9.4 Critical
- wavlink wl-wn579a3-aWAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection10.0 Critical
- presentonPresenton Desktop Authentication Middleware app_data information disclosure6.9 Medium
- presentonPresenton API missing authentication6.9 Medium
- cgohlke imagecodecsimagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3_decode()6.8 Medium
- cgohlke imagecodecsimagecodecs 2026.3.6 through 2026.10.10 Infinite Loop via ccittfax4_decode()6.8 Medium
- marketcalls openalgoOpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections6.0 Medium
- thelia back-office default twig templateThelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes6.9 Medium
- thelia, thelia back-office default twig template, core +2 moreThelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads4.6 Medium
- ffmpegFFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure6.8 Medium
- ffmpegFFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder6.8 Medium
- ffmpegFFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder6.8 Medium
- ffmpegFFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder6.8 Medium
- ffmpegFFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette6.8 Medium
- No product listedPostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting5.1 Medium
- d-link dir-505D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow10.0 Critical
- linuxnet: skbuff: propagate shared-frag marker in skb_zerocopy()9.8 Critical
- google androidIn acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write...8.4 High
- google androidIn multiple locations, there is a possible way to modify coprocessor instruction and data memory...6.7 Medium
- google androidIn multiple locations, there is a possible way to trigger an out of bounds write in the shared...8.4 High
- google androidIn slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer...7.8 High
- google androidIn knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a...7.8 High
- google androidIn StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write...8.4 High
- google androidIn multiple functions of face_status.h, there is a possible way to modify verified biometric...6.4 Medium
- google androidIn sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to...7.8 High
:unknown:AndroidNo score- unisoc (shanghai) technologies co., ltd. bootloaderOut-of-bounds Write in Bootloader8.4 High
- unisoc (shanghai) technologies co., ltd. modemImproper Input Validation in Modem Firmware7.5 High
platform/vendor/opensource/display-coreAndroidNo scoreplatform/vendor/opensource/display-coreAndroidNo score- google androidIn userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in...3.3 Low
- Show moreLoading…