CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- enspirit eloElo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter9.8 Critical
- enspirit eloElo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels9.8 Critical
- netbox-community netboxNetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView5.3 Medium
- enspirit eloElo: Code injection in Elo backends via unvalidated emission of programmatic AST fields7.4 High
Microsoft.DotNet.ILCompilerNuGet,Microsoft.NETCore.App.Runtime.android-arm64NuGet,Microsoft.NETCore.App.Runtime.android-x64NuGet +64 more +66 moreMicrosoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability8.1 High- phpmyadmin motranslatorphpMyAdmin MoTranslator Loader.php getTranslator path traversal5.3 Medium
- bagistoBagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting6.3 Medium
- jarun bukubuku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL5.3 Medium
- willamowius gnugkGNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler6.3 Medium
- willamowius gnugkGNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing6.3 Medium
- nanosystems supremoNanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation7.6 High
- lightdashLightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints2.3 Low
- clickcease click fraud protection, eranfl clickcease click fraud protection +1 moreWordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability5.3 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability4.3 Medium
- wpvibes anywhere elementorWordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability5.3 Medium
- phpmyadmin sql-parserphpMyAdmin SQL-Parser ExplainStatement.php parse type conversion6.9 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability4.3 Medium
- wpvibes anywhere elementorWordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dokan, inc. dokanWordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability5.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability4.3 Medium
- dokan, inc. dokanWordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability5.3 Medium
- barn2 plugins posts table with search & sortWordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpvibes anywhere elementorWordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability6.5 Medium
github.com/tinfoil-factory/netfoilGoNetfoil doesn't decrement TTLNo score- wpmu dev forminatorWordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability5.3 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability4.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability5.3 Medium
- uncanny owl automatorWordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability5.3 Medium
- elastic docker imagesImproper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections7.4 High
- elastic apm serverAllocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service6.5 Medium
- elastic elasticsearchAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic elasticsearchUse of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure4.2 Medium
- elastic elasticsearchIncorrect Authorization in Elasticsearch Leading to Information Disclosure4.3 Medium
- elastic packetbeatNULL Pointer Dereference in Packetbeat Leading to Denial of Service6.5 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- elastic kibanaImproper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion7.3 High
- elastic kibanaInsertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure6.5 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- elastic elasticsearchUncontrolled Recursion in Elasticsearch Leading to Denial of Service7.5 High
- elastic apm serverUse of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure4.3 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ajay better searchWordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability5.3 Medium
- phpmyadmin shapefilephpMyAdmin ShapeFile SHP File loadFromFile infinite loop5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreGst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator6.5 Medium
github.com/basekick-labs/arcGoArc has unauthenticated application log disclosure via `/api/v1/logs`No score- sonicwall global management system (gms)Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL...6.8 Medium
- wlrootswlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c4.8 Medium
- solanum-ircd solanumSolanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler8.5 High
- solanum-ircd solanumSolanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN8.5 High
- texlyreTeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import5.3 Medium
- Show moreLoading…