CVEs published in November 2026
7,997 vulnerabilities, 689 critical, 12 exploited.
- apache software foundation ofbizApache OFBiz: Missing Authorization vulnerability6.5 Medium
- apache software foundation ofbizApache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation6.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations7.5 High
- apache software foundation ofbizApache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access9.8 Critical
- apache software foundation ofbizApache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities7.5 High
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification5.4 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association5.4 Medium
- apache ofbizApache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation6.5 Medium
- apache ofbizApache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover7.4 High
- apache ofbizApache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session6.1 Medium
- apache ofbizApache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders8.1 High
- apache ofbizApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification6.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification6.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure6.5 Medium
- apache ofbizApache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts6.5 Medium
- agentscope-ai agentscopeagentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization6.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.9, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names9.1 Critical
- red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +7 more +9 moreIo.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw7.7 High
- agentscope-ai agentscopeagentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection6.9 Medium
- kobikom telecommunications and informatics services inc. kobikomSQL Injection in Kobikom Telecommunications' Kobikom7.5 High
- kobikom telecommunications and informatics services inc. kobikomPath Traversal in Kobikom Telecommunications' Kobikom7.5 High
- sensiolabs symfonySymfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)2.3 Low
haproxyUbuntuhaproxy regressionNo score- eosphoros-ai db-gpteosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine5.3 Medium
- apache software foundation sling engineApache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling7.5 High
- apache software foundation sling engineApache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization7.5 High
- apache software foundation sling engineApache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths5.4 Medium
- tubitak bilgem software technologies research institute pardus-usb-formatterImproper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter6.6 Medium
- eclipse foundation basyx helm chartsKeycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts7.5 High
- eclipse foundation basyx helm chartsKeycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts7.5 High
- eosphoros-ai db-gpteosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere6.9 Medium
ocipkgcrates.io`ocipkg` is unmaintainedNo scorermcpcrates.ioUnbounded response body buffering in Streamable HTTP clients6.5 Medium- apache software foundation juneauApache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory10.0 Critical
- apache software foundation juneauApache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome10.0 Critical
- apache software foundation juneauApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data10.0 Critical
- apache software foundation juneauApache Juneau: REST client forwards credentials to a different origin when following HTTP redirects10.0 Critical
- apache software foundation juneauApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults10.0 Critical
- apache software foundation juneauApache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors10.0 Critical
- apache software foundation juneauApache Juneau: Cross-site request forgery via default-enabled content query-parameter body override10.0 Critical
- apache software foundation juneauApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing10.0 Critical
- apache software foundation juneauApache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling8.7 High
- eosphoros-ai db-gpteosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection6.9 Medium
- shirasagi project shirasagiAn OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated...8.7 High
- shirasagi project shirasagiA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated...5.1 Medium
- jopenlibs vault-java-drivervault-java-driver: stored deeply nested JSON kills every thread that reads it6.5 Medium
- jopenlibs vault-java-drivervault-java-driver: SslConfig silently disables requested TLS verification7.4 High
- dokan, inc. dokanDokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon2.2 Low
- unknown security for woocommerceSecurity For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user9.8 Critical
- ixsystems truenas scaleAuthentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25...8.3 High
- Show moreLoading…