CVEs published in November 2026
7,962 vulnerabilities, 684 critical, 12 exploited.
- hcl aionHCL AION is affected by multiple security vulnerabilities.6.5 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.7 Low
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.7 Low
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.7 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.7 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.7 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.7 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.7 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.7 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.7 Low
- esengine deepseek-reasonixesengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input5.3 Medium
- No product listedUnauthenticated arbitrary file read via path traversal in `/conferences/ocaml/**`7.5 High
- hcl aionHCL AION is affected by multiple security vulnerabilities.5.4 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.2 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.8 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.4.8 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.7 Low
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.7 Low
- tubitak bilgem software technologies research institute pardus-boot-repairPath Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair4.3 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp swings upsell order bump offer for woocommerceWordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability7.1 High
- tubitak bilgem software technologies research institute pardus-boot-repairPath Traversal in TÜBİTAK BİLGEM's pardus-boot-repair6.6 Medium
- sensiolabs symfonySymfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers2.3 Low
ocamlopamEphemeron data is freed while still referenced when the key is an `Infix_tag` closure7.0 High- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
shinchina-testcrates.io`shinchina-test` was removed from crates.io for malicious codeNo scoresec-geminicrates.io`sec-gemini` was removed from crates.io for malicious codeNo scoreshinchinacrates.io`shinchina` was removed from crates.io for malicious codeNo scoretop_level_cratecrates.io`top_level_crate` was removed from crates.io for malicious codeNo scorebuild_depcrates.io`build_dep` was removed from crates.io for malicious codeNo scorevodozemaccrates.ioDegraded secret zeroization capabilitiesNo scorevodozemaccrates.ioDegraded secret zeroization capabilitiesNo scoreactix-filescrates.ioHidden file disclosure through Windows short namesNo scoreactix-httpcrates.ioLarge-window Brotli bodies bypass decompression memory limitsNo scoreactix-httpcrates.ioRequest smuggling through malformed chunked request trailersNo score- actix actix-http, actix-web +1 moreactix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder8.7 High
- apache software foundation jamesApache James: Denial of service upon MIME parsing8.7 High
- apache software foundation james mime4j core, james mime4j dom +1 moreApache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling7.5 High
moodleUbuntuMoodle: missing access checks on h5p content files7.5 High- apache software foundation jamesApache James: ManageSieve file implementation cross-user path traversal9.8 Critical
- apache software foundation jamesApache James: WebAdmin exposed without authentication on official Docker default9.1 Critical
- apache software foundation jamesApache James: SSRF filter bypass in the JMAP PushSubscription web-push client9.1 Critical
- apache software foundation jamesApache James: Negative IMAP ACL administer authorization bypass through JMAP protocol7.5 High
- apache software foundation jamesApache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigredNo score
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title5.4 Medium
- themekraft buddyformsBuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion5.4 Medium
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info5.4 Medium
- jiangweifang live2dwebcanvasLive2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter8.1 High
- nicola modugno smart cookie kitSmart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration5.4 Medium
- Show moreLoading…