CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- surrealdbSurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations7.1 High
- parse-community parse-serverParse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key6.3 Medium
- parse-community parse-serverParse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update8.2 High
- parse-community parse-serverParse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession2.3 Low
- freerdpFreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly7.1 High
- freerdpFreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry2.3 Low
- freerdpFreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_25.3 Medium
- freerdpFreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token8.2 High
- freerdpFreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel6.0 Medium
- freerdpFreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel7.1 High
- freerdpFreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload5.3 Medium
- freerdpFreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control5.3 Medium
- freerdpFreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP5.3 Medium
- freerdpFreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet5.3 Medium
- freerdpFreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet7.1 High
- freerdpFreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length5.3 Medium
- freerdpFreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module8.2 High
- freerdpFreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()5.3 Medium
- freerdpFreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion5.3 Medium
- freerdpFreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder7.1 High
- freerdpFreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion7.1 High
- freerdpFreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate9.1 Critical
- freerdpFreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE5.3 Medium
- freerdpFreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response5.3 Medium
- freerdpFreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging2.3 Low
- freerdpFreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder5.3 Medium
- d3tn gmbh µd3tnOut-of-bounds Write in µD3TN7.5 High
- d3tn gmbh µd3tnMissing Release of Memory after Effective Lifetime in µD3TN7.5 High
- d3tn gmbh µd3tnOut-of-bounds Read in µD3TN7.1 High
- d3tn gmbh µd3tnOut-of-bounds Write in µD3TN7.5 High
- d3tn gmbh µd3tnUse After Free in µD3TN5.9 Medium
- d3tn gmbh µd3tnDouble Free in µD3TN5.9 Medium
- ntpsecOut-of-bounds Write in NTPsec7.4 High
- ntpsecOut-of-bounds Read in NTPsec3.7 Low
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Layout: Block and Inline component8.8 High
- nagios enterprises xiNagios XI < 2026R2 OS Command Injection via mibs.php8.6 High
- zephyrproject zephyrUse-after-free via dynamically allocated message queue retained by the CAN RX filter8.8 High
- zephyrproject zephyrOut-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers6.7 Medium
- zephyrproject zephyrBluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer4.6 Medium
- zephyrproject zephyrUse-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress4.8 Medium
- mongodb node.js driverMongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data8.3 High
- eclipse foundation mnestixUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter7.5 High
- nvidia nvjpeg, cuda toolkit +1 moreNVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A...5.5 Medium
- corebunch instaticInstatic before 0.0.21 Authorization Bypass via MCP Content Read Tools7.1 High
github.com/certifi/gocertifiRoot,rootio-github.com/certifi/gocertifiRoot +1 moreAIKIDO-2026-230832 in github.com/certifi/gocertifi - Patched by RootNo score- linuxtcp: Fix potential UAF in reqsk_timer_handler().8.1 High
- buddyboss appBuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint8.8 High
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- Show moreLoading…