CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- eclipse foundation mnestixUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures9.2 Critical
- bitdefender pybddisasmUninitialized output buffer returned after nd_to_text failure in pybddisasm6.9 Medium
- bitdefender pybddisasmUninitialized INSTRUX contents returned after decoding failure in pybddisasm4.8 Medium
- bitdefender pybddisasmUse-after-free in INSTRUX array members in pybddisasm6.9 Medium
- bitdefender pybddisasmUse-after-free in INSTRUX structure members in pybddisasm6.9 Medium
- bitdefender pybddisasmOut-of-bounds reads during instruction decoding in pybddisasm4.8 Medium
- welotec tk100, tk500-v2, tk500-v3 +2 moreBuffer Overflow in Digital I/O6.9 Medium
- welotec tk100, tk500-v2, tk500-v3 +2 moreCommand Injection in IPsec VPN8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 moreCommand Injection in Digital I/O8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 moreCommand Injection in WireGuard VPN8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 moreCommand Injection in ZeroTier VPN8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 moreCommand Injection in Management Control Functions8.6 High
- axxonsoft axxonnetRead-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet5.3 Medium
- axxonsoft axxonnet arp agentLDAP Bind Password Exposure in AxxonNet ARP Agent Logs6.8 Medium
- axxonsoft axxon oneDefault Administrator Password Change Not Enforced in Axxon One Web Client9.2 Critical
- axxonsoft axxon onePlaintext Storage of LDAP Password in Axxon One Shared Configuration6.8 Medium
- eclipse foundation semantic modeling framework (esmf)Improper limitation of paths in py-aspect-model-loader9.8 Critical
- axxonsoft axxon oneUser and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API5.3 Medium
pdfjs-distRoot,@rootio/pdfjs-distRoot +1 moreAIKIDO-2026-169371 in pdfjs-dist - Patched by RootNo scoreexconRootAIKIDO-2026-331213 in excon - Patched by RootNo score- eclipse foundation threadxThreadX Modules invokes trace-full callbacks after module unload7.3 High
- eclipse foundation threadxUser-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege8.5 High
- eupago gateway for woocommerce, unknown eupago gateway for woocommerce +1 moreEupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass5.3 Medium
- unknown cryptocloudCryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret5.3 Medium
rootlesskitSUSESecurity update for rootlesskitNo scoreaws-sdk-coreRootAIKIDO-2026-948376 in aws-sdk-core - Patched by RootNo score- wso2 api manager, api control plane, identity server key manager connector (apim-km-wso2is) +2 morePrivilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)9.8 Critical
libcatalyst-plugin-authentication-perlDebianCatalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier7.5 High- zohocorp eventlog analyzer, log360 +1 moreAuthentication Bypass7.5 High
- qtOut-of-bounds read vulnerability in CoAP message parsing impacts Qt CoAP6.7 Medium
- zohocorp eventlog analyzer, log360 +1 moreImproper Access Control vulnerability9.1 Critical
- naver billboard.jsbillboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper...6.1 Medium
- naver whale browserWhale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab...7.5 High
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification6.1 Medium
- wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 moreImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers4.8 Medium
- unknown wemailweMail <= 2.1.6 - Editor+ API Key Disclosure4.9 Medium
- unknown wemailweMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()3.8 Low
- hieu nguyen wati chat and notificationWATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token5.3 Medium
- unknown dt lmsDT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation5.3 Medium
- unknown dt directory lite addonDT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update5.3 Medium
- ghozylab gallery for social photoGallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter5.8 Medium
- unknown azexo store locatorAZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item6.5 Medium
- zohocorp manageengine key manager plusAuthentication bypass vulnerability7.7 High
- zohocorp manageengine key manager plusTwo-factor authentication bypass7.4 High
- migkapa ai alt text generatorAI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter5.3 Medium
- wpmanageninja fluentcart a new era of ecommerce – faster, lighter, and simplerFluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter8.1 High
- jordy meow photo engine (media organizer & lightroom)Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name6.4 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture8.1 High
- surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & paymentsSureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover8.1 High
- amirhelzer wpml multilingual & multicurrency for woocommerceWPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field4.9 Medium
- Show moreLoading…