CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- acf extended advanced custom fields: extended proAdvanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type9.8 Critical
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification5.3 Medium
- satindersingh contact form extender for divi – submissions db & extra fieldsContact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal7.5 High
- blazethemes news kit addons for elementorNews Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action6.4 Medium
- zorem advanced shipment tracking for woocommerceAdvanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter7.2 High
- tigroumeow seo engine – smart seo with ai, schema & redirection for wordpressSEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()6.4 Medium
- aresit wp compress – instant performance & speed optimizationWP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters5.3 Medium
- kodezen academy lms – ai course builder, quizzes, certificates & elearningAcademy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route4.3 Medium
- alex githatu buddypress xprofile custom image fieldBuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler9.1 Critical
- red hat build of apache camel 4 for quarkus 3, build of apicurio registry 3, build of debezium 3 +6 more +8 moreOrg.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses5.3 Medium
haproxySUSESecurity update for haproxyNo scorehaproxySUSESecurity update for haproxyNo scorehaproxyopenSUSESecurity update for haproxyNo score- emrevona wp fastest cache – wordpress cache pluginWP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response5.9 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreLibslirp: libslirp: queue pointer corruption in if_output() leading to denial of service6.5 Medium
- zyxel nwa110ax firmwareA buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through...8.8 High
- zyxel gs1900-24e firmware, gs1900-10hp firmware, gs1900-16 firmware +7 more +9 moreAn out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions...8.8 High
- octo-sts appOcto STS discloses trust policy contents to unauthorized callers via Exchange error messages5.3 Medium
- nist labbenchlabbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch8.5 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreLibslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure7.4 High
- No product listedA hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to...7.5 High
- No product listedA Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0...9.8 Critical
- No product listedAn issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS...9.8 Critical
- freerdpFreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment8.7 High
- freerdpFreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close8.2 High
- freerdpFreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read7.2 High
- freerdpFreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest8.7 High
- freerdpFreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame7.1 High
- freerdpFreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys8.7 High
- freerdpFreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race8.7 High
- freerdpFreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt8.7 High
- freerdpFreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext8.7 High
- freerdpFreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec7.1 High
- freerdpFreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close9.3 Critical
- freerdpFreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability9.3 Critical
- freerdpFreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event8.7 High
- freerdpFreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap7.1 High
- freerdpFreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA7.1 High
- freerdpFreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics7.1 High
- freerdpFreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder7.1 High
- freerdpFreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST7.1 High
- freerdpFreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers8.7 High
- No product listedhustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user...7.1 High
squidDebian,squid3Ubuntu +1 moreStack Buffer Overflow in HTTP AuthenticationNo score- xenarbitrary read/write via grant copy4.4 Medium
- xenarbitrary read/write via grant copy4.4 Medium
- johnson controls easyio neo ec and cw edge controllerAuthentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO...8.7 High
- welcart e-commerce pluginWelcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting5.3 Medium
- artifex software inc. *pymupdf* pymupdfPyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout7.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreHivex: hivex: denial of service via out-of-bounds read in big-data block processing2.0 Low
- Show moreLoading…