CVEs published in November 2026
8,005 vulnerabilities, 689 critical, 12 exploited.
drupal/content_synchronizerPackagistThe Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialize…No score- yezhihao jt808-serveryezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication6.9 Medium
- ayecode ltd payment forms, buy now buttons, and invoicing system | getpaidGetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass8.7 High
- ayecode ltd payment forms, buy now buttons, and invoicing system | getpaidGetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice6.9 Medium
- ayecode ltd payment forms, buy now buttons, and invoicing system | getpaidGetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API7.1 High
- cisco unified computing system central softwareCisco Unified Computing System Central Remote Code Execution Vulnerability7.6 High
- cisco unified communications managerCisco Unified Communications Manager Cross-Site Scripting Vulnerability6.1 Medium
- cisco ise passive identity connector, identity services engine software +1 moreCisco Identity Services Engine Authorization Bypass Vulnerability5.3 Medium
minetestMageiaUpdated minetest package fixes security vulnerabilitiesNo score- prosoft technology icx35-hwc-e, x35-hwc-a +1 moreProSoft ICX35 Login Lockout Bypass via Client-Side Cookies8.2 High
- coderCoder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal2.3 Low
- traefikTraefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak7.0 High
- parse-community parse-serverParse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key6.0 Medium
- sharpemuSharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution8.3 High
- warp-tech warpgateWarpgate: Kubernetes listener discloses internal error text to an unauthenticated caller3.7 Low
- warp-tech warpgateWarpgate: Kubernetes authorization correlation can be reused by a recreated same-name account6.8 Medium
- eclipse foundation mojarraReflected XSS via client window id in URL client window mode6.1 Medium
- oqtane oqtane.frameworkOqtane Framework before 10.3.0 SSRF via File Upload From URL5.3 Medium
- oqtane oqtane.frameworkOqtane Framework before 10.3.0 Broken Access Control via SettingController7.4 High
- watchguard authpoint authentication gatewayWatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions9.1 Critical
- watchguard authpoint authentication gatewayWatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service9.2 Critical
- watchguard authpoint authentication gatewayWatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks9.1 Critical
- watchguard authpoint authentication gatewayWatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results8.9 High
- No product listedData::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping6.1 Medium
- frroutingfrr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses6.1 Medium
- rubyonrails active storageActive Storage: Possible arbitrary file write and read in image analysis9.8 Critical
- sender – newsletter, sms and email marketing automation for woocommerceSender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download5.3 Medium
- elixir-ecto ectoUnbounded query cache growth from interpolated JSON paths and splice lists in Ecto8.9 High
- wedevs wepos – point of sale (pos) for woocommerce & dokanwePOS before 2.0.3 Missing Authorization via payment/process Endpoint5.3 Medium
- wp hosting pay with vipps and mobilepay for woocommercePay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery6.3 Medium
warpHackageHTTP Request Smuggling in warpNo score- tata motors ira 2.0, ira.ev +1 moreSecurity Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application8.5 High
- tata motors ira 2.0, ira.ev +1 moreInformation Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application6.8 Medium
- coopcycle coopcycle-webCoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification8.3 High
- tata motors ira 2.0, ira.ev +1 moreInsecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application7.1 High
- zbateson mail-mime-parserzbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders6.9 Medium
- coopcycle coopcycle-webCoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint7.2 High
- munt libmt32emulibmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex8.5 High
- stonewuu ai-fusion-videoStonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers8.7 High
- david-crty databasementDatabasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking9.2 Critical
- moyangzhan langchain4j-aideepinlangchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}6.0 Medium
- blackholll loonflowloonflow before r3.2.3 IDOR via ticket_flow_history Endpoint2.3 Low
- cosin2077 easyvoiceeasyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API6.9 Medium
- tata motors ira 2.0, ira.ev +1 moreHardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application8.8 High
- qtInteger truncation vulnerability in QTextCodec conversion functions impacts Qt Framework1.7 Low
- uncanny owl toolkit for learndashWordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability9.8 Critical
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability9.8 Critical
- brian mutende noptinWordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
heifer-hevc-deccrates.ioPanic on chroma QP offsets enabled with an empty offset list6.5 Mediumheifer-hevc-deccrates.ioPanic on an HEVC tile layout that does not match the active SPS6.5 Medium- Show moreLoading…