CVEs published in November 2026
8,018 vulnerabilities, 689 critical, 12 exploited.
- hewlett packard enterprise (hpe) fabric composerAuthenticated Local Arbitrary File Write Vulnerability in HPE Networking Fabric Composer7.8 High
- hewlett packard enterprise (hpe) fabric composerAuthenticated Missing Integrity Verification in API of HPE Networking Fabric Composer8.0 High
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer8.0 High
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric Composer8.1 High
- hewlett packard enterprise (hpe) fabric composerAuthentication Bypass in the Affected Interface of HPE Networking Fabric Composer8.1 High
- hewlett packard enterprise (hpe) fabric composerLocal Privilege Escalation in HPE Networking Fabric Composer8.2 High
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer8.3 High
- hewlett packard enterprise (hpe) fabric composerImproper Certificate Validation in HPE Networking Fabric Composer8.7 High
- hewlett packard enterprise (hpe) fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API8.8 High
- hewlett packard enterprise (hpe) fabric composerUse of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution9.6 Critical
- hewlett packard enterprise (hpe) fabric composerAuthentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution9.6 Critical
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access9.8 Critical
- vembu technologies bdrsuiteVembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp5.1 Medium
- isomorphic-gitisomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)8.8 High
- vembu technologies bdrsuiteVembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp5.1 Medium
- isomorphic-gitisomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)4.3 Medium
- isomorphic-gitisomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)4.3 Medium
- tp-link systems inc. tapo cloud serviceServer-Side Request Forgery in Tapo Cloud MQTT Proxy8.3 High
- tp-link systems inc. tapo cloud serviceBroken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy8.3 High
- isomorphic-gitisomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout5.3 Medium
- yeti-platform yetiYeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export7.1 High
- mongodb entity framework core providerEF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference2.3 Low
- yeti-platform yetiYeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write8.3 High
- docker buildxBake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx7.3 High
- yeti-platform yetiYeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data7.5 High
- yeti-platform yetiYeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters7.6 High
- agamnentzar ag-psdag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)7.5 High
- team-alembic ash authenticationAshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change6.3 Medium
- koxudaxi fastapi-code-generatorfastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator9.3 Critical
- koxudaxi fastapi-code-generatorfastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict9.3 Critical
- koxudaxi fastapi-code-generatorfastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring9.3 Critical
- docker desktopDocker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall9.2 Critical
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation5.3 Medium
- mongodb atlas sql jdbc driverAtlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler5.1 Medium
- mongodb c driverSilent element-count truncation via 32-bit bit-length overflow in packed-bit vector views6.3 Medium
- netcore nbr100v2Netcore NBR100V2 auto_ac msg_aes_dec integer overflow8.7 High
- mongodb c driverMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata8.7 High
- aws maplibre-gl-js-amplifyStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering4.8 Medium
- mongodb c driverremote abort and memory disclosure from a malformed cursor.ns7.1 High
- mongodb c driverMongoDB C Driver GridFS gap lets a shared writer recover a protected client's password6.0 Medium
- mongodb c driverMongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)8.7 High
- traptitech traqtraQ: Privilege escalation by OAuth prompt=none request7.3 High
- red hat openshift container platform 4, openshift container platform 5 +1 moreImage-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret7.1 High
- mongodb rust driverRust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command6.8 Medium
- traptitech traqtraQ: XSS in the User Uploaded File Retrieval API7.3 High
- armurox loggingredactorLogging Redactor: PII data in str/repr of non primitive objects was not being redacted8.2 High
- amazon aurora postgresql with babelfish, aws babelfish-for-postgresql +1 moreBabelfish for PostgreSQL Privilege Escalation8.7 High
- linuxfabrik monitoring-pluginsMonitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary7.0 High
- zeroturnaround zt-zipzt-zip: ZipUtil.unpack can change file permissions of output directory6.9 Medium
- zeroturnaround zt-zipzt-zip: Path traversal in fluent API unpack6.1 Medium
- Show moreLoading…