CVEs published in November 2026
7,997 vulnerabilities, 689 critical, 12 exploited.
- open-emr openemrOpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot7.5 High
- opentext directory services (otds)A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows...5.3 Medium
- freeswitchFreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling7.5 High
- freeswitchFreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data8.2 High
- freeswitchFreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY9.1 Critical
- opentext directory services (otds)Improper neutralization of input during web page generation ('cross-site scripting')...6.3 Medium
- opentext directory services (otds)A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse...7.1 High
- freeswitchFreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding8.2 High
- freeswitchFreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing2.7 Low
- freeswitchFreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing7.5 High
- freeswitchFreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands9.8 Critical
- freeswitchFreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server7.4 High
- freeswitchFreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing5.3 Medium
- freeswitchFreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling9.1 Critical
- freeswitchFreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia8.8 High
- freeswitchFreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length7.5 High
- freeswitchFreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling7.5 High
- freeswitchFreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header construction5.9 Medium
- freeswitchFreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication7.5 High
- freeswitchFreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing7.5 High
- opentext operations bridge manager, universal discovery and cmdb +1 moreOpen redirect vulnerability - UCMDB/Operations Bridge Manager5.1 Medium
- freeswitchFreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing7.5 High
- freeswitchFreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name6.5 Medium
- hewlett packard enterprise (hpe) hpe cray programming environmentIn HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE...7.8 High
- freeswitchFreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls7.5 High
- signalwire freeswitchFreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences5.9 Medium
- signalwire freeswitchFreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user6.5 Medium
- suitecrmSuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection9.4 Critical
- suitecrmSuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)8.8 High
- suitecrmSuiteCRM: Authenticated SQL Injection In action_get_end_date function6.5 Medium
- imagemagickImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder7.1 High
- mark3labs mcp-gomcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata5.1 Medium
- diillson chatcliChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator5.1 Medium
- langgenius difylanggenius dify Sandbox Run __init__.py hard-coded credentials5.3 Medium
- suitecrmSuiteCRM: V8 OAuth2 Username Enumeration6.9 Medium
- suitecrmSuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list8.8 High
- suitecrmSuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record7.1 High
- suitecrmSuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)7.1 High
- suitecrmSuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack7.1 High
- suitecrmSuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User8.8 High
- suitecrmSuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database8.8 High
- suitecrmSuiteCRM: LFI to RCE via AOW_WorkFlow9.9 Critical
- suitecrmSuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management8.8 High
- suitecrmSuiteCRM: SQL injection via search param in modules/Cases/controller.php8.3 High
- suitecrmSuiteCRM: Authenticated SQL Injection in map_markers distance Parameter8.8 High
- suitecrmSuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php8.3 High
- suitecrmSuiteCRM: AOR Reports aor_fields.field SQL Injection6.5 Medium
- suitecrmSuiteCRM: Authenticated SQL Injection In handleAttachments function7.1 High
- suitecrmSuiteCRM: Authenticated SQL Injection In Project Module7.1 High
- suitecrmSuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php6.5 Medium
- Show moreLoading…