CVEs published in November 2026
8,005 vulnerabilities, 689 critical, 12 exploited.
- wowza streaming engineWowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote...7.5 High
- opnsense os-acme-clientAn OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of...9.4 Critical
- godotsteamGodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A...6.5 Medium
- unknown wp pagenavi styleWP PageNavi Style <= 1.4 - Stored XSS via CSRF7.1 High
- catfoldersCatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge3.1 Low
- catfoldersCatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting6.8 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.3.3 - Admin+ Cross-Site Vendor Activation2.7 Low
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form5.3 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint6.5 Medium
- unknown car dealer (dealership) and vehicle salesCar Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax5.3 Medium
- unknown easy social iconsEasy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload6.8 Medium
- unknown ivpay paymentsIVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter9.3 Critical
- unknown cloud blocksCloud Blocks <= 1.1.8 - Unauthenticated Stored XSS8.8 High
- exactly www ewww image optimizerEWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute6.4 Medium
- g5theme essential real estateEssential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR4.3 Medium
- g5theme essential real estateEssential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax4.3 Medium
- g5theme essential real estateEssential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure5.3 Medium
- unknown easy social iconsEasy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings3.5 Low
- g5theme essential real estateEssential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending5.3 Medium
- g5theme essential real estateEssential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax5.3 Medium
- unknown yith woocommerce gift cards, yith woocommerce gift cards +1 moreYITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition3.7 Low
- unknown subscriptions for woocommerceSubscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass5.3 Medium
- jackdewey community eventsCommunity Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_list5.3 Medium
- unknown wp event manager, wp event manager event manager +1 moreWP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR8.2 High
- themeum tutor lmsTutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure4.3 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import5.0 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption6.8 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers4.3 Medium
- saad iqbal all in one loginAll In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force9.8 Critical
- unknown wp event manager, wp event manager event manager +1 moreWP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids8.1 High
- iterm2iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler,...8.7 High
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile6.4 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter8.8 High
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key6.4 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching8.2 High
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter8.1 High
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute6.4 Medium
- stmicroelectronics st-mems-android-linux-sensors-halSTMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the...4.2 Medium
- twilio-labs netlify-okta-auth@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an...7.2 High
- openhandsOpenHands Landing missing authentication5.3 Medium
- itsourcecode airline reservation systemitsourcecode Airline Reservation System manage_booked.php sql injection5.3 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System Category Management add_category.php cross site scripting4.8 Medium
- openppl ppl.nnOpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds5.3 Medium
- deepgraphlearning knowledgegraphembeddingDeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversal5.3 Medium
- samsung exynos 1280, exynos 1330, exynos 1380 +16 more +18 moreIn the NAS message handler, improper validation of the length field in NAS message causes memory...9.8 Critical
- samsung exynos 1280, exynos 1330, exynos 1380 +6 more +8 moreIn the NR RRC component, improper handling of messages before authentication triggers a data...9.8 Critical
- samsung exynos 1280, exynos 1330, exynos 1380 +6 more +8 moreIn the baseband, memory corruption during NAS packet processing can cause a denial of service.7.5 High
- samsung exynos 1280, exynos 1330, exynos 1380 +8 more +10 moreProcessing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of...5.5 Medium
- samsung exynos 2200, exynos 2400, samsung semiconductor exynos 2500 +1 more +3 moreOut of bound access in PPC due to race condition in global variable access8.8 High
- samsung exynos 1280, exynos 1330, exynos 1380 +10 more +12 moreImproper handling of messages before AS security activation can cause unexpected behavior9.1 Critical
- Show moreLoading…