CVEs published in November 2026
7,969 vulnerabilities, 686 critical, 12 exploited.
- danbilabs advanced members for acfAdvanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form8.8 High
- progressplanner aaa autoload optimizerAAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook4.9 Medium
- plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videosAll-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field6.4 Medium
- aguilatechnologies wp customer areaWP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter6.4 Medium
- themekraft buddyformsBuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter9.8 Critical
- creativewerkdesigns wpsyncsheets for contact form 7 – cf7 google sheets connector & save to databaseWPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()7.5 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint6.5 Medium
- elextensions elex wordpress helpdesk & customer ticketing systemELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter9.1 Critical
- pubjet | پابجتPubjet | پابجت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action7.6 High
- ericsson codecheckerAuthenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics4.9 Medium
django-oauth-toolkitRootAIKIDO-2026-11011 in django-oauth-toolkit - Patched by RootNo scoredjango-storagesRootAIKIDO-2025-10101 in django-storages - Patched by RootNo score- ericsson codecheckerStored XSS in the static HTML report export, because json.dumps does not escape the markup character0.0 None
- ninenines cowboyCowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion8.2 High
- ninenines cowlibUnbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion8.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19656 users without update permission could change issue...3.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI...3.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization ...3.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS...3.8 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible...3.8 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage...4.7 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via...6.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint...7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed...7.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted...7.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message...7.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation...8.4 High
- jetbrains webstormIn JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects...6.3 Medium
- jetbrains webstormIn JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was...7.8 High
- jetbrains toolbox appIn JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting...3.1 Low
- jetbrains ktorIn JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage...3.7 Low
- jetbrains ktorIn JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine4.8 Medium
- jetbrains ktorIn JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies8.1 High
- jetbrains junie cliIn JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session...5.5 Medium
- jetbrains junie cliIn JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar...7.0 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response...3.1 Low
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via...3.3 Low
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files...3.3 Low
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in...5.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from...5.4 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web...6.1 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in...6.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary...6.8 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added...7.4 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container...7.5 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured...7.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was...7.8 High
- Show moreLoading…