CVEs published in November 2026
8,007 vulnerabilities, 689 critical, 12 exploited.
- unknown form maker by 10webForm Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values7.5 High
- unknown erp: complete hr, accounting & crm suite built for woocommerceWP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log4.3 Medium
- unknown cookieyesCookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts6.4 Medium
- mollie payments for woocommerce, unknown mollie payments for woocommerce +1 moreMollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order3.7 Low
- mollie payments for woocommerce, unknown mollie payments for woocommerce +1 moreMollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay3.7 Low
- zohocorp manageengine key manager plusCommand injection vulnerability8.8 High
- zohocorp manageengine key manager plusImproper access control vulnerability7.7 High
- wso2 identity server, identity application management component +1 morePrivilege Escalation via Client Credentials Grant Type in WSO2 Identity Server7.2 High
- line corporation armeriaA vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing…5.1 Medium
- line corporation armeriaA vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validi…7.6 High
- akeeba ltd. admin tools for joomla!, backup for joomla!, backup for wordpress +1 more +3 moreMultiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious...5.1 Medium
- linksys e5600Linksys E5600 Factory Quality Control fqc.cgi information disclosure6.9 Medium
- linksys e5600Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write8.7 High
- better-auth better auth@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated...9.1 Critical
- linksys e5600Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write6.9 Medium
- linksys e5600Linksys E5600 Login mesh_login.cgi improper authentication10.0 Critical
- asus router firmwareOut-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to...7.2 High
- asus router firmwareStack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby...8.7 High
- asus system control interfaceAn exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local...8.5 High
- asus armoury crateMissing authorization in ASUS Armoury Crate allows a local attacker to write content into a...6.9 Medium
- No product listedfunadmin Frontend List Endpoint index selectList sql injection6.9 Medium
- qihoo 360 whole home router m5Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials10.0 Critical
- qihoo 360 d600-2, d603-2, d606-6 +2 moreQihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection6.9 Medium
- qihoo 360 d600-2, d603-2, d606-6 +1 more +3 moreQihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection10.0 Critical
- qihoo 360 d600-2, d603-2, d606-6 +3 more +5 moreQihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification10.0 Critical
- totolink a950rgTOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow9.4 Critical
- totolink a950rgTOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow9.4 Critical
- totolink a950rgTOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow9.4 Critical
- totolink a950rgTOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow9.4 Critical
ofonoDebian[Unknown description]No scoreofonoDebian[Unknown description]No scoreofonoDebian[Unknown description]No scoreofonoDebian[Unknown description]No scoreofonoDebian[Unknown description]No scoreofonoDebian[Unknown description]No score- No product listedOn HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a...7.2 High
- No product listedOn HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is...9.8 Critical
kojiUbuntu[Unknown description]No scorepagureDebian[Unknown description]No score- the gnu c library glibcBIG-HKSCS decoding hang on crafted input5.9 Medium
- spipSPIP before 4.4.29 Authenticated SQL Injection via where Parameter7.1 High
- sensiolabs symfonySymfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References8.2 High
- freerdpFreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race8.2 High
- irontec sngrepsngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV6.8 Medium
- irontec sngrepIrontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet6.3 Medium
- mchehab zbarZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c6.9 Medium
- sensiolabs symfonySymfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)5.3 Medium
libsql-abstract-perlDebian,perl-sql-abstractAlpine +1 moreSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func7.3 Highlibsql-abstract-perlDebian,perl-sql-abstractAlpine +1 moreSQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile5.4 Mediumlibsql-abstract-perlDebian,perl-sql-abstractAlpine +1 moreSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position7.3 High- Show moreLoading…