CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- jarun nnnnnn through 5.3 Symlink-Following Write via NNN_FIFO Handling1.0 Low
- jarun nnnnnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins4.1 Medium
- jarun nnnnnn through 5.3 OS Command Injection via togglex Plugin8.4 High
- canop dyskdysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata1.0 Low
- novik rutorrentruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following6.0 Medium
- robiningelbrecht dreeveDreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler6.9 Medium
- koodo-readerKoodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers6.9 Medium
- a466350665 smart-ssosmart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation8.7 High
- dbgateDbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save5.3 Medium
- padlocPadloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests6.3 Medium
- dataease sqlbotSQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint5.1 Medium
- mlogclub bbs-gobbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service8.3 High
- amir1376 ab-download-managerAB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF8.7 High
- paicni cfnextCFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID7.7 High
- eclipse foundation vert.xHeap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client5.9 Medium
- amd compressionator sdkAn integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to...6.9 Medium
- amd compressionator sdkAn out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local...5.2 Medium
- amd compressionator sdkAn out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with...5.2 Medium
- amd compressionator sdkA heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an...5.2 Medium
- amd compressionator sdkAn integer overflow condition in the AMD Compressonator SDK could allow an attacker with local...5.1 Medium
- amd athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 4004 series processors, epyc™ 4005 series processors +38 more +40 moreA NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and...6.9 Medium
- runzero platformrunZero search SQL injection6.5 Medium
- eclipse foundation vert.xCachingWebClient shares user-specific HTTP responses across users via the shared cache tier7.5 High
- ivanti connect secureUse of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6...4.3 Medium
- finsys dockhandDockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook7.1 High
- finsys dockhandDockhand before 1.0.54 Path Traversal via Stack Environment Routes8.7 High
- darylldoyle svg-sanitizersvg-sanitizer before 1.1.0 XSS via animateTransform on Safari5.3 Medium
- darylldoyle svg-sanitizersvg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes5.3 Medium
- darylldoyle svg-sanitizersvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping8.2 High
- darylldoyle svg-sanitizersvg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph8.7 High
- darylldoyle svg-sanitizersvg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag6.9 Medium
- frappe hrmsFrappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API5.3 Medium
- lepture mistuneMistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing6.9 Medium
- lepture mistuneMistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters8.7 High
- froxlorFroxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php8.6 High
- froxlorFroxlor before 2.3.15 Authorization Bypass via Mysqls.add API5.3 Medium
- froxlorFroxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API5.3 Medium
- azuracastAzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export5.1 Medium
- azuracastAzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist5.1 Medium
- azuracastAzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors6.9 Medium
- azuracastAzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints5.3 Medium
- azuracastAzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()8.7 High
- azuracastAzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone8.7 High
- azuracastAzuraCast through 0.23.8 Config Injection via frontend_config.custom_config8.7 High
- surrealdbSurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization7.1 High
- surrealdbSurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass5.1 Medium
- surrealdbSurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass5.3 Medium
- surrealdbSurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses4.8 Medium
- surrealdbSurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision8.6 High
- surrealdbSurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner5.3 Medium
- Show moreLoading…