CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- sea-team gofoundGoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop7.2 High
- sea-team gofoundGoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results5.1 Medium
- xianhc ape-volo-adminape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass9.3 Critical
- owntone serverOwnTone Server through 29.3 SQL Injection via MPD sticker find Command6.9 Medium
- quickjs-ngQuickJS-NG before 0.16.0 Memory Leak via Atomics.store6.9 Medium
- quickjs-ngQuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort8.3 High
- quickjs-ngQuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration8.5 High
- netpbmNetpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm6.9 Medium
- netpbmNetpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm8.5 High
- netpbmNetpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm8.5 High
- netpbmNetpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly8.5 High
- netpbmNetpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly8.5 High
- netpbmNetpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopam8.5 High
- netpbmNetpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow8.5 High
- owen2345 camaleon cmsCamaleon CMS before 2.9.2 IDOR via Admin::CategoriesController5.3 Medium
- owen2345 camaleon cmsCamaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController7.1 High
- chaitin pandawikiPandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass5.1 Medium
- zmister2016 mrdocMrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read5.3 Medium
- opencsg csghubOpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route8.7 High
- munafio chatifyChatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint7.1 High
- codeixer product gallery slider & additional variation images for woocommerceProduct Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX8.6 High
- benhoyt inihinih before r63 Stack Buffer Under-Read in ini_parse_stream Discard Loop4.8 Medium
pipRootAIKIDO-2026-949486 in pip - Patched by RootNo score- starnet computer and network systems inventory tracking applicationSQL Injection in Starnet Computer Systems' Inventory Tracking Application7.5 High
- regularlabs.com articles anywhere extension for joomla, sourcerer free extension for joomla, sourcerer pro extension for joomla +2 moreJoomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.18.9 High
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.8.6 High
- php-web-design.com stageit extension for joomlaJoomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.57.2 High
- php-web-design.com stageit extension for joomlaJoomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.58.6 High
- php-web-design.com stageit extension for joomlaJoomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.55.3 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.8.6 High
- regularlabs.com users anywhere (free, pro) extension for joomlaJoomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.15.1 Medium
- apache software foundation syncopeApache Syncope: SQL injection via unsanitized opEvent in Audit Events search9.8 Critical
- apache software foundation syncopeApache Syncope: RCE via ProcessGroovyMethodsSandbox bypass9.8 Critical
- apache software foundation syncopeApache Syncope: Delegated administration boundaries can be bypassed for Realm update9.1 Critical
- sassanix warrackerWarracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking6.0 Medium
- apache software foundation syncopeApache Syncope: AuthProfile value escalation via self-service update8.8 High
- apache software foundation syncopeApache Syncope: Remote Code Execution via Flowable JUEL expression9.8 Critical
- barracuda email security gateway 300 firmware, email security gateway 400 firmware, email security gateway 600 firmware +3 more +5 moreAuthentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway9.3 Critical
- barracuda email security gateway 300 firmware, email security gateway 400 firmware, email security gateway 600 firmware +13 more +15 moreOS Command Injection in Barracuda Appliances8.6 High
virtualenvRootAIKIDO-2026-785880 in virtualenv - Patched by RootNo scorevirtualenvRootAIKIDO-2026-674766 in virtualenv - Patched by RootNo score- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a...6.1 Medium
- tubitak bilgem software technologies research institute eta-registerLocal Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register7.8 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment...5.5 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of...6.4 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment...5.5 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of...8.0 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input...6.8 Medium
- wso2 identity serverOpen Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks4.3 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of...5.7 Medium
- Show moreLoading…