CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- coollabsio coolifyCoolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints6.9 Medium
- sonicwall global management system (gms)An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions...9.1 Critical
- solarwinds damewareSolarWinds Dameware Command Injection Vulnerability9.9 Critical
- solarwinds damewareSolarWinds Dameware Buffer Overflow Vulnerability8.4 High
- mongodb database toolsmongorestore may restore encoded collection names into an unintended collection2.1 Low
- solarwinds damewareSolarWinds Dameware DLL Hijacking Vulnerability8.2 High
- docker sandboxesDocker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory8.4 High
- mongodb database toolsmongofiles may write outside the working directory through a symlink1.0 Low
- mongodb database toolsmongofiles may disclose GridFS content to standard output through a stored filename5.9 Medium
- mongodb database toolsmongorestore may bypass collection guards through a system.buckets prefix5.2 Medium
- team-alembic ash authenticationAshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource6.3 Medium
- team-alembic ash authenticationAshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account7.6 High
- djangoproject djangoServer-side request forgery via SpatialReference string input6.9 Medium
- djangoproject djangoPassword hash disclosure to "view only" admin users with custom user models2.1 Low
- djangoproject djangoPotential exposure of private data via empty and missing Vary headers2.3 Low
- djangoproject djangoServer-side request forgery via crs member of GeoJSON geometries6.9 Medium
- djangoproject djangoPotential log injection via unescaped geometry form values6.9 Medium
- djangoproject djangoPotential memory exhaustion in MultiPartParser via base64-encoded file upload6.9 Medium
- hdfgroup hdf5NULL Pointer Dereference in H5HL_unprotect via Corrupted File5.4 Medium
- nvidia slurmNVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket...7.0 High
- nvidia slurmNVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist...5.3 Medium
- nvidia slurmNVIDIA Slurm contains some inconsistent authorization checks against the Operator permission...5.7 Medium
- nvidia slurmNVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that...6.3 Medium
- hdfgroup hdf5Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse6.9 Medium
- nvidia slurmNVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API...6.3 Medium
- nvidia slurmNVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could...4.7 Medium
- amidaware tactical rmmCVE-2026-1215786.1 Medium
- hdfgroup hdf5Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize1.9 Low
- ziroom zhome a0101Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection9.4 Critical
- hdfgroup hdf5, the hdf group szip filter +1 moreInteger Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter4.7 Medium
- eclipse foundation vert.xHeap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser7.5 High
- rsyncproject rsyncrsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions8.7 High
- lucasrodes whatstkSilent loss of messages when merging overlapping chat exports in whatstk1.8 Low
- hdfgroup hdf5, the hdf group scale-offset filter +1 moreUninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter1.9 Low
- securepoint ssl vpn client v2Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows6.9 Medium
- nvidia slurmNVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process...6.3 Medium
- nvidia slurmNVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as...6.3 Medium
- volmarg personal-management-systemVolmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/8.6 High
- ctfdCTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint6.9 Medium
- humansignal label-studio, label-studio-sdk +1 moreLabel Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads6.3 Medium
- logchimpLogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts7.1 High
- glpi-project glpiGLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning8.6 High
- ricky-7-yan intelligent-audit-systemAuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id2.3 Low
- wppconnect wppconnect-serverWPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot8.2 High
- beecue fastbeeFastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints8.7 High
- drizzletime foxelFoxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb8.7 High
- silkimen cordova-plugin-advanced-httpcordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects8.2 High
- cotontiCotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())6.3 Medium
- dromara domain-admindomain-admin before 1.6.79 Missing Authorization via getGroupUserList5.3 Medium
- postfixadminPostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description5.1 Medium
- Show moreLoading…