CVEs published in November 2026
8,007 vulnerabilities, 689 critical, 12 exploited.
- sensiolabs symfonySymfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control6.3 Medium
- sensiolabs symfonySymfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)7.7 High
iwdDebian[Unknown description]No scorelibweb-simple-perlDebianWeb::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output6.1 Medium- fasterxml jackson-dataformat-cborjackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)7.5 High
- git-for-windows gitGit for Windows: git-credential-wincred Erase Path Heap Overflow4.4 Medium
- git-for-windows gitGit for Windows: git-credential-wincred OAuth Store Heap Overflow4.4 Medium
- quest foglight for databasesQuest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability7.2 High
- quest foglight for databasesQuest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- quest foglight for databasesQuest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability8.2 High
- quest foglight for databasesQuest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability7.8 High
- quest foglight for databasesQuest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability7.2 High
- quest foglight for databasesQuest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability9.8 Critical
- quest foglight for databasesQuest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability9.8 Critical
- quest foglight for databasesQuest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability6.5 Medium
- quest foglight for databasesQuest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability8.8 High
- quest foglight for databasesQuest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- pixar openusdPixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability7.8 High
- mailenableMailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability6.5 Medium
- mailenableMailEnable Auth Cleartext Storage Information Disclosure Vulnerability5.9 Medium
- libwebsocketslibwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability8.1 High
- nomachineNoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability9.8 Critical
- mlflowMLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability8.2 High
- mlflowMLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- mlflowMLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability5.4 Medium
- mlflowMLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability6.3 Medium
- mlflowMLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability5.4 Medium
- mlflowMLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- spatie url-signerspatie url-signer URL Validation AbstractUrlSigner.php validate type conversion6.9 Medium
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set7.5 Highlibcgi-pm-perlDebian,perl-CGIAlmaLinux +1 moreCGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits6.5 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment6.1 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename9.8 Criticallibcgi-pm-perlDebian,perl-CGIopenSUSE +1 moreCGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo7.5 Highlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list7.5 Highlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values9.1 Criticallibcgi-pm-perlDebian,perl-CGIopenSUSE +1 moreCGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url6.1 Mediumlibcgi-pm-perlDebian,perl-CGIAlmaLinux +1 moreCGI versions before 5.00 for Perl return request-derived values untainted under taint mode9.1 Criticallibcgi-pm-perlDebian,perl-CGIAlmaLinux +1 moreCGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths8.8 Highlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields6.5 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push7.2 Highlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect6.1 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD9.8 Criticallibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form6.1 Medium- Show moreLoading…