CVEs published in November 2026
7,969 vulnerabilities, 686 critical, 12 exploited.
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was...8.2 High
- jetbrains hubIn JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to...2.7 Low
- jetbrains hubIn JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible3.1 Low
- jetbrains hubIn JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible5.0 Medium
- jetbrains hubIn JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the...6.8 Medium
- jetbrains hubIn JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible7.5 High
- jetbrains hubIn JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the...8.1 High
- jetbrains hubIn JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email...9.6 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted...7.8 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained...2.7 Low
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's...4.3 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via...5.3 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files5.4 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link5.4 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 private notebook files could be downloaded without...5.9 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file...5.9 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.3 command execution was possible in the database task container...6.3 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only...6.5 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre...6.8 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new...7.4 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container...7.5 High
- jetbrains dataloreIn JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published...8.1 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by...9.0 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC...6.7 Medium
- jetbrains clionIn JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to...5.0 Medium
- jetbrains clionIn JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a...7.8 High
- ericsson codecheckerSession Token Remains Valid After Logout in Multi-Worker Deployments5.3 Medium
- qcam saxyXML injection in Saxy via unescaped CDATA section terminator2.1 Low
- qcam saxyProcessing instruction target and content emitted unescaped in Saxy encoder allows XML injection2.1 Low
- qcam saxyXML comment injection in Saxy encoder via unescaped double hyphen2.1 Low
sqlparseRootAIKIDO-2026-576438 in sqlparse - Patched by RootNo score- undiciundici vulnerable to cross-user information disclosure via cross-origin redirect revalidation5.9 Medium
- infomaniak network vod infomaniakVOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action4.3 Medium
- man4toman parsi date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیتWp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute6.4 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter5.3 Medium
- yaycommerce yaysmtp – wp mail smtp with email logs, tracking & reportsYaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter4.9 Medium
- wahid0003 product feed manager for woocommerce – ctx feed – support 220+ shopping, ai & social channelsProduct Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter7.2 High
- realmag777 mdtf – meta data and taxonomies filterMDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter7.2 High
- arraytics eventin – events calendar, tickets, registration, booking & woocommerceEventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter6.5 Medium
- wpusermanager wp user manager – registration form, login form, user profile builder & member directoryWP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta6.4 Medium
- atmira sirecSQL injection in Atmira’s SIREC8.7 High
ioredisRoot,@rootio/ioredisRoot +1 moreAIKIDO-2026-967850 in ioredis - Patched by RootNo score- circl vulnerability-lookupVulnerability-Lookup: memory amplification through webhook payload template format specifiers5.3 Medium
- maciej bis permalink manager litePermalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug6.4 Medium
- magepeopleteam travelly – tour & travel booking manager for woocommerceTravelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen6.5 Medium
- barn2 plugins posts table with search & sortPosts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute6.4 Medium
- iqonicdesign graphina – charts and graphs for elementorGraphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings7.2 High
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute6.4 Medium
adm-zipRoot,@rootio/adm-zipRoot +1 moreAIKIDO-2026-363221 in adm-zip - Patched by RootNo scoreadm-zipRoot,@rootio/adm-zipRoot +1 moreAIKIDO-2026-327281 in adm-zip - Patched by RootNo score- Show moreLoading…