CVEs published in November 2026
8,007 vulnerabilities, 689 critical, 12 exploited.
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs8.1 Highlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer6.5 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port6.1 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type6.5 Mediumlibcgi-pm-perlDebian,perl-CGIopenSUSE +1 moreCGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse7.5 High- infiniflow ragflowInfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization5.3 Medium
- sanluan publiccmsSanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization5.3 Medium
- emerson ovationEmerson Ovation Insufficient Verification of Data Authenticity8.7 High
- emerson ovationEmerson Ovation Missing Authentication for Critical Functionality9.3 Critical
- No product listedUmami Record API Endpoint route.ts authorization6.9 Medium
- nocodbNocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation6.9 Medium
- blueprintue blueprintue-self-hosted-editionblueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens6.3 Medium
- zane-opsZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView6.0 Medium
- webkul bagistoBagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload2.1 Low
- francoisjacquet rosariosisRosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment2.1 Low
- francoisjacquet rosariosisRosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report8.7 High
- 0xdps emailflareemailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint7.1 High
- 0xdps emailflareemailflare before commit cf31f33 Missing Authorization via /api/keys Routes7.2 High
- sourcehut meta.sr.htSourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step26.9 Medium
- jorisvink koreKore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()8.7 High
- alcpu core tempThe Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an...8.4 High
- github enterprise serverOut-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service5.3 Medium
- github enterprise serverCross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console5.3 Medium
- github enterprise serverUse-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service7.7 High
- No product listedArcReel Provider Test-Connection Endpoint test server-side request forgery5.3 Medium
scientificHackageOut-of-bounds read in Eq and Ord on numbers with extreme exponentsNo scorescientificHackageSuperlinear encoding of numbers with large coefficientsNo score- miroslavpejic85 mirotalk p2pmiroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control5.3 Medium
- tanium discoverTanium addressed an uncontrolled resource consumption vulnerability in Discover.4.3 Medium
- tanium discoverTanium addressed an information disclosure vulnerability in Discover.4.3 Medium
- tanium enforceTanium addressed an improper access controls vulnerability in Enforce.6.5 Medium
- tanium threat responseTanium addressed an unauthorized code execution vulnerability in Threat Response.7.5 High
- tanium deployTanium addressed a heap-based buffer overflow vulnerability in Deploy.7.2 High
- tanium discoverTanium addressed an improper access controls vulnerability in Discover.4.2 Medium
- tanium discoverTanium addressed an information disclosure vulnerability in Discover.4.3 Medium
- tanium discoverTanium addressed an improper access controls vulnerability in Discover.3.1 Low
- tanium enforceTanium addressed an improper access controls vulnerability in Enforce.6.5 Medium
- tanium discoverTanium addressed an improper output sanitization vulnerability in Discover.4.1 Medium
- tanium data service, interact +1 moreTanium addressed a path traversal vulnerability in Tanium Data Service.5.0 Medium
- bluecats reveal, tanium asset, comply +10 more +12 moreTanium addressed an improper certificate validation vulnerability in multiple products7.4 High
- tanium threat responseTanium addressed an improper input validation vulnerability in Threat Response.6.5 Medium
- tanium threat responseTanium addressed an improper input validation vulnerability in Threat Response.4.3 Medium
- tanium threat responseTanium addressed an unauthorized code execution vulnerability in Threat Response.7.5 High
- tanium threat responseTanium addressed a business logic error in Threat Response.4.3 Medium
- miroslavpejic85 mirotalk p2pmiroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication6.3 Medium
- tanium discoverTanium addressed an improper access controls vulnerability in Discover.6.5 Medium
- tanium threat responseTanium addressed an uncontrolled resource consumption vulnerability in Threat Response.4.3 Medium
- tanium clientTanium addressed a denial of service vulnerability in Tanium Client.6.5 Medium
- moby buildkitMalicious client could set xattr value outside of BuildKit state directory4.5 Medium
- moby buildkitPossible panic from Git source resolver6.7 Medium
- Show moreLoading…