CVEs published in November 2026
7,997 vulnerabilities, 689 critical, 12 exploited.
- trellix dlp on-prem extensionsHard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1...6.0 Medium
- anacrolix torrentanacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response7.1 High
- mpv-player mpvmpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines7.7 High
- huginnHuginn before 2026.11.05 Stored XSS via OAuth Service Display Name5.1 Medium
- blosc c-blosc2Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()6.8 Medium
- libsdl-org sdl mixerSDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder8.5 High
- libsdl-org sdl mixerSDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder8.5 High
- arthi-chaud meeloMeelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints5.3 Medium
- chevere spa cheveretoChevereto before 4.5.8 Private Album Image Disclosure via get-album-contents6.9 Medium
- fossasia eventyay-exhibitioneventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API2.3 Low
- oss-apps splitproSplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails2.3 Low
- oss-apps splitproSplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query5.3 Medium
- trellix dlp on-prem extensionsSQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote...7.1 High
- cendio thinlincCendio ThinLinc Improper Authentication via Web Access7.7 High
ca-certificatesUbuntu,ca-certificates-javaUbuntu +1 moreca-certificates updateNo score- openbmb internet of agentsOpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication6.9 Medium
- apache software foundation ofbizApache OFBiz: Authenticated Path Traversal in Catalog Image Management6.5 Medium
- apache software foundation ofbizApache OFBiz: Dispatch arbitrary internal services on SFA component8.1 High
- apache software foundation ofbizApache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading7.5 High
- apache software foundation ofbizApache OFBiz: Unauthenticated path-suffix view authorization bypass7.5 High
- apache software foundation ofbizApache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact7.5 High
- apache software foundation ofbizApache OFBiz: Unauthenticated HR organization and employee disclosure5.3 Medium
- apache software foundation ofbizApache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode9.1 Critical
- apache software foundation ofbizApache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage6.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization - catalog quick-admin product writes6.5 Medium
- apache software foundation ofbizApache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services6.5 Medium
- apache software foundation ofbizApache OFBiz: Authorization bypass - self-grant content OWNER6.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization - search-result bulk catalog mutation6.5 Medium
- apache software foundation ofbizApache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB9.8 Critical
- apache software foundation ofbizApache OFBiz: XML external entity injection (XXE)3.5 Low
- apache software foundation ofbizApache OFBiz: Server-side request forgery in SurveyWrapper8.1 High
- apache software foundation ofbizApache OFBiz: Content renderer runs a service name stored on the row7.5 High
- apache ofbizApache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile4.3 Medium
- apache ofbizApache OFBiz: Unbounded multi-form row count from a parameter name7.5 High
- apache ofbizApache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound9.8 Critical
- apache ofbizApache OFBiz: renderLink compiles link parameters as FreeMarker source8.8 High
- apache ofbizApache OFBiz: Unsandboxed Groovy compiled from a service parameter8.8 High
- apache ofbizApache OFBiz: webtools xmldsdump exports any entity to any path7.1 High
- apache ofbizApache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE8.8 High
- apache ofbizApache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers5.3 Medium
- itsourcecode online book storeitsourcecode Online Book Store admin_edit.php sql injection6.9 Medium
- apache ofbizApache OFBiz: Unauthenticated RCE via login-page widget injection9.8 Critical
- apache ofbizApache OFBiz: Content Manager VIEW-only RCE in updateLayout8.8 High
- apache ofbizApache OFBiz: Cross-tenant authorization bypass in mapped-domain login5.4 Medium
- apache ofbizApache OFBiz: Authenticated Code Execution Vulnerability8.8 High
- fileorbis informatics services trade inc. fileorbisHTML Injection in Fileorbis6.1 Medium
- apache ofbizApache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation7.3 High
- apache ofbizApache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service6.5 Medium
- agentscope-ai agentscopeagentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication6.9 Medium
- apache ofbizApache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass6.5 Medium
- Show moreLoading…