CVEs published in November 2026
7,969 vulnerabilities, 686 critical, 12 exploited.
- infinitt healthcare uliteBrute-forceable image-share link password in INFINITT ULite7.5 High
- infinitt healthcare uliteReflected XSS in INFINITT ULite login error page (pre-auth)6.1 Medium
- hclsoftware bigfix mcm & mobileBigFix Mobile is affected by sensitive information disclosure6.3 Medium
mozilla-nssSUSESecurity update for mozilla-nssNo score- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- cyberlord92 oauth single sign on – sso (oauth client)WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability9.8 Critical
- mamunur rashid radius booking — booking calendar for appointments & servicesWordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability9.8 Critical
- genetech products pie registerWordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability7.1 High
- david anderson redux frameworkWordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bakkbone australia floristpressWordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability7.5 High
- hclsoftware bigfix mcm & mobileBigFix Mobile is affected by a Cross-site scripting vulnerability6.3 Medium
- line corporation armeriaA vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.8.7 High
- line corporation armeriaA vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and acce…8.7 High
- line corporation armeriaA vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and…2.4 Low
- line corporation armeriaA vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visit…5.3 Medium
- line corporation armeriaA vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size befo…8.7 High
- line corporation armeriaA vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-t…5.9 Medium
- fullworks quick event managerQuick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter5.3 Medium
- rustaurius order trackingOrder Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener5.3 Medium
- unknown wp libre formWP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload10.0 Critical
- dvankooten mc4wp: mailchimp for wordpressMC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag4.8 Medium
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation8.0 High
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion9.1 Critical
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR8.8 High
axiosRoot,@rootio/axiosRoot +1 moreSNYK-JS-AXIOS-9403194 in axios - Patched by RootNo score- red hat openshift ai (rhoai)Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)No score
- red hat openshift ai (rhoai)Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master9.1 Critical
- red hat build of keycloakKeycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator6.5 Medium
axiosRoot,@rootio/axiosRoot +1 moreSNYK-JS-AXIOS-6144788 in axios - Patched by RootNo scoreaxiosRoot,@rootio/axiosRoot +1 moreSNYK-JS-AXIOS-6124857 in axios - Patched by RootNo score- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover6.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v25.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: admin api missing audience check6.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding4.2 Medium
- ruben garcia automatorwpAutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback5.6 Medium
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changesPublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure4.3 Medium
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changesPublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR2.7 Low
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changesPublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow4.9 Medium
- dvankooten mc4wp: mailchimp for wordpressMC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override5.3 Medium
- unknown shopengine gutenberg woocommerce builder blocks addonBlocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css6.8 Medium
- unknown anti-spam, spam firewall by cleantalkAnti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email7.5 High
- unknown gs jwt authentication for wp rest apiGS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi9.8 Critical
- unknown advanced custom fields (acf®)Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection7.5 High
- unknown cool media filterCool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission8.8 High
- unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + moreiubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser7.5 High
- unknown wcfm membershipWCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass6.5 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta8.0 High
- Show moreLoading…