CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- apache software foundation wicketApache Wicket: A listener is invoked on a page instance the request itself created and never configured6.9 Medium
- apache software foundation wicketApache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation2.3 Low
- apache software foundation wicketApache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke2.3 Low
- apache software foundation wicketApache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission6.9 Medium
- apache software foundation wicketApache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource6.3 Medium
- beecue fastbeebeecue FastBee Groovy Script Executor script code injection5.1 Medium
- ruijie rg-es205gc, rg-es206gc-p, rg-es208gc +2 more +4 moreRuijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting4.8 Medium
- ruijie rg-es205gc, rg-es206gc-p, rg-es208gc +2 more +4 moreRuijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow8.7 High
- wavlink wn553x1-bWAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection9.4 Critical
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption5.3 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Transport Decoder input validation5.3 Medium
- No product listedGoogle::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state8.8 High
- No product listedGoogle::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials9.8 Critical
- ag-ui-protocol ag-uiag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption5.3 Medium
- nickboss wordpress file uploadWordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability9.3 Critical
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability6.5 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui HTTP Transport e.text resource consumption5.3 Medium
- prefecthq prefab-uiPrefab UI Pyodide sandbox escape to host RCE10.0 Critical
- ag-ui-protocol ag-uiag-ui-protocol ag-ui HttpAgent http.ts information disclosure6.9 Medium
- horizon datasys reboot restore standardHorizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption9.3 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection9.4 Critical
- wavlink wn701aeWAVLINK WN701AE ioos Web Backend del_vlan_group os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B ioos sub_416B50 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B ioos Service sub_416D88 os command injection9.4 Critical
- lud jsvjsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not2.1 Low
- beam-cloud beta9 gateway, beta9 worker +1 moreBeta9 host filesystem exposure via volume path traversal9.9 Critical
- beam-cloud beta9 workerBeta9 container escape via unvalidated sandbox file paths9.9 Critical
- beam-cloud beta9 workerBeta9 build sandbox escape via chroot-only isolation9.9 Critical
- wavlink wn701aeWAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection9.4 Critical
evtxcrates.ioUnbounded memory allocation in `evtx` parsing a `.wevtcache` file5.5 Mediumrio-vtcrates.ioPath traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)4.7 Medium- hangzhou xiongmai technology p2papi.dllHangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI_Connect buffer overflow4.8 Medium
- No product listedHTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI5.6 Medium
- oray pugongying x5 proOray Pugongying X5 Pro openwrt_release config_restore_ex path traversal9.4 Critical
- oray pugongying x5 proOray Pugongying X5 Pro API Authorization run_async_task improper authorization9.4 Critical
- oray pugongying x5 proOray Pugongying X5 Pro Session ID session.lua session_get random values2.3 Low
- giteaGitea limited-visibility profile disclosure with public-only tokens4.3 Medium
- giteaGitea user and organization feed token scope bypass4.3 Medium
- giteaGitea private pull request disclosure on project boards7.5 High
- giteaGitea public-only token bypass on bulk organization repository deletion7.5 High
- giteaGitea issue changes on archived repositories through the API6.5 Medium
- giteaGitea public-only token bypass in repository and organization creation7.5 High
- giteaGitea OAuth2 userinfo private group disclosure to public-only tokens4.3 Medium
- giteaGitea public-only package token access to private OCI blobs9.1 Critical
- giteaGitea Helm chart upload decompression denial of service6.5 Medium
- giteaGitea private issue disclosure through issue dependency timeline events3.5 Low
- giteaGitea private repository listing to public-only tokens on profiles4.3 Medium
- Show moreLoading…