CVEs published in November 2026
8,005 vulnerabilities, 689 critical, 12 exploited.
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Broken Access Control via S3 Token Endpoint9.3 Critical
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API IDOR via profile_id Endpoints6.9 Medium
- @contentful mcp-server, tsparticles +1 moretsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS7.5 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking8.2 High
- nst labs tech nstbrowserNST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service5.3 Medium
- sandboxie-plus sandboxieSandboxie-Plus: Sandbox containment bypass6.9 Medium
- shenzhen shine industrial co., ltd. vitafitVitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure8.6 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure8.7 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config5.1 Medium
- shenzhen shine industrial co., ltd. vitafitVitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation8.7 High
- readestReadest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller6.5 Medium
- readestReadest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)6.5 Medium
- 6amtech 6valley6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization6.9 Medium
- readestReadest: Unauthenticated SSRF / open request proxy in /api/opds/proxy9.3 Critical
- aws aws-network-policy-agent, amazon-vpc-cni-k8s +1 moreImproper isolation of shared resources in aws-network-policy-agent in Amazon EKS6.3 Medium
- readestReadest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview8.6 High
- automattic mongooseMongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)6.5 Medium
- h2oh2o: heap exhaustion using capsules7.5 High
- h2oh2o: buffer overflow when using the %{error}x log directive8.1 High
- gpustackGPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover8.8 High
- nvm-sh nvmnvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write6.7 Medium
- alan health alan: health insuranceAlan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity6.9 Medium
- nvm-sh nvmnvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files4.6 Medium
- nvm-sh nvmnvm prints the contents of any readable file through a symlinked .nvmrc6.7 Medium
- yangzongzhuan ruoyi-vueyangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management5.3 Medium
- nvm-sh nvmnvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable1.8 Low
- nvm-sh nvmnvm install --offline installs a cached tarball that previously failed checksum verification2.1 Low
- nvm-sh nvmnvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line2.0 Low
- nvm-sh nvmnvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases2.1 Low
- gpustackGPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover9.1 Critical
- gpustackGPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin9.8 Critical
- npc-worldwide npcpyNPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation5.3 Medium
- xerrors yuxiYuxi sandbox isolation failure allows cross-tenant access and internal service compromise9.9 Critical
- janhq janJan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink5.7 Medium
- benjamine jsondiffpatchjsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters2.3 Low
- php frankenphpFrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode6.3 Medium
- ibm watson speech services cartridgeIBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith6.5 Medium
- ibm watson speech services cartridgeIBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read in Onnx5.3 Medium
- ibm watson speech services cartridgeIBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL9.8 Critical
- ibm watson speech services cartridgeIBM Watson Speech Services Cartridge is vulnerable to a D.O.S. in Unpacker.7.5 High
- npc-worldwide npcpyNPC-Worldwide npcpy sft.py load_sft_model code injection5.3 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub4.3 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub3.5 Low
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub4.6 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub5.4 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub4.3 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub3.3 Low
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub4.3 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub5.9 Medium
- ibm db2 genius hub, agentics +1 moreMultiple vulnerabilities that affects IBM Db2 Genius Hub6.5 Medium
- Show moreLoading…