CVEs published in November 2026
8,005 vulnerabilities, 689 critical, 12 exploited.
- parse-community parse-serverParse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response2.3 Low
- samsung exynos 1080, samsung semiconductor exynos 9110, exynos modem 5123 +2 more +4 moreIncorrect handling of SIP packets leads to baseband crashes5.3 Medium
- edge0-ai audio8 ttsEdge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal5.3 Medium
- invoiceshelfInvoiceShelf MemberService.php create access control5.1 Medium
- purocean yank notePurocean Yank Note Terminal index.ts checkPermission os command injection5.3 Medium
- samsung exynos 1080, exynos 1280, exynos 1330 +17 more +19 moreContinuously sending control‑plane messages causes the baseband to crashes.7.5 High
- purocean yank notepurocean Yank Note Settings Endpoint index.ts config.getAll information disclosure6.9 Medium
- presentonPresenton User Configuration user-config JSON.parse cross-site request forgery5.3 Medium
- 101arrowz fflate101arrowz fflate index.mjs unzipSync memory allocation6.9 Medium
- ntt data intellilink corporation hinemosIncorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an...7.1 High
- nliautaud pico-content-editornliautaud pico-content-editor cross-site request forgery5.3 Medium
tpm2.0-toolsopenSUSEtpm2.0-tools-5.8-1.1 on GA mediaNo score- red hat ansible-coreA flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is...5.5 Medium
python-laspyDebianlaspy LAS File lasreader.py memory allocation5.3 Medium- sensiolabs symfonySymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)2.3 Low
- sensiolabs symfonySymfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File8.4 High
- symfonySymfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls6.3 Medium
iwdDebian[Unknown description]No score- No product listedReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through...6.5 Medium
- No product listedNewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView...5.4 Medium
- No product listedChewy for Android version 26.23.0 does not adequately validate the host of a product-details deep...8.1 High
- No product listedAn issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive...7.5 High
- edimax br-6208acEdimax BR-6208AC mp command injection10.0 Critical
- campcodes complete sales and inventory system with credit managementCampcodes Complete Sales and Inventory System with Credit Management login.php sql injection6.9 Medium
- campcodes bitcoin wallet systemCampcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication6.3 Medium
- campcodes division regional athletic meet game result matrix systemCampcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection6.9 Medium
- jelmer dulwichDulwich before 1.2.20 Commit Parser Tree Header Misinterpretation8.6 High
- webminWebmin: SSRF exploit in Upload and Download and File Manager modules4.9 Medium
- veracryptVeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path)8.8 High
- openedx openedx-platformOpen edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce5.3 Medium
- wazuhWazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML5.3 Medium
- campcodes complete advance loan management systemCampcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload6.9 Medium
- pocket-idPocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing9.6 Critical
- krupalshah employeerecruitmentsystemkrupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection6.9 Medium
- pocket-idPocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences7.7 High
- radare2radare2: Remote code execution when loading Pebble/SMD binary8.5 High
- glpi-project glpiGLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds5.3 Medium
- glpi-project glpiGLPI: Blind Time based SQLI in dropdowns8.7 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Authentication Bypass via POST /front/login/sns/9.3 Critical
- glpi-project glpiGLPI: MFA bypass9.2 Critical
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Excessive Data Exposure via relation/search Endpoint7.1 High
- glpi-project glpiGLPI: Unallowed notifications sending7.1 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access6.3 Medium
- mayswind ezbookkeepingezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header5.3 Medium
- nst labs tech nstbrowserNST Labs Tech Nstbrowser Local Agent API info information disclosure5.3 Medium
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure8.7 High
- @contentful mcp-server, tsparticles +1 moretsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process8.7 High
- tsparticlestsParticles: Generated release notes can execute shell commands in the stable publish workflow7.5 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Stored XSS via SVG File Upload5.1 Medium
- @contentful mcp-server, tsparticles +1 moretsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients6.9 Medium
- Show moreLoading…