CVEs published in November 2026
7,962 vulnerabilities, 684 critical, 12 exploited.
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.1 Low
- 201206030 novelxxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorization6.9 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.6.5 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.1 Low
- sensiolabs symfonySymfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process8.7 High
- gridaco gridaGrida through 0.0.24 Missing Authorization in Forms File-Preview API8.2 High
- openbmb internet of agentsOpenBMB Internet of Agents Code Executor Tool code_executor.py execute_code code injection6.9 Medium
- posit software, pbc workbench, rstudio server +1 moreRStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership4.7 Medium
- posit software, pbc workbenchPosit Workbench code-server session-state RPC (get_last_seen) SQL injection5.7 Medium
- agenta-ai agentaAgenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token8.4 High
- fluxboxFluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry6.8 Medium
- fluxboxFluxbox through 1.3.7 OS Command Injection via Style Background Values8.5 High
- skyvernSkyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode8.7 High
- zhimaai chatwikiChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired5.3 Medium
- zhimaai chatwikiChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand5.3 Medium
- userminUsermin through 2.570 XSS via mailbox detach.cgi type Parameter5.1 Medium
- userminUsermin through 2.570 Path Traversal File Write via detachall.cgi8.6 High
- userminUsermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion7.7 High
- lektorLektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths5.9 Medium
- abpframework abpABP Framework before 10.7.1 Authentication Bypass via External Login Provider7.6 High
- openwhydOpenwhyd before 1.65.1 NoSQL Injection via POST /api/user6.9 Medium
- siyuan-note siyuanSiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read6.9 Medium
- craftcms cmsCraft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select8.8 High
- craftcms cmsCraft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass8.7 High
- craftcms cmsSQL injection leading to privilege escalation9.3 Critical
- craftcms cmsCraft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria7.1 High
- craftcms cmsCraft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint9.3 Critical
- parse-community parse-serverParse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex8.7 High
- wwbn avideoWWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php6.0 Medium
- sgoudelis ground-stationGround Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources7.1 High
- wazuhWazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params7.1 High
- wazuh wazuh-dashboard-pluginsWazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request8.8 High
- wazuhWazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module8.2 High
- wazuhWazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination8.2 High
- wazuhWazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination6.3 Medium
- wazuhWazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder7.1 High
- wazuhWazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull6.8 Medium
- wazuhWazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf6.9 Medium
- charmbracelet wishCharmbracelet Wish 2.0.5 Path Traversal via git Middleware8.6 High
- python software foundation cpythonRegression in FIPS enforcement of hash algorithms affecting only Python 3.14.108.2 High
- No product listedkubescape Output printresults.go GetWriter permission2.4 Low
- sensiolabs symfonySymfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request2.3 Low
- zephyrproject zephyrNULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame7.5 High
- nasa-gcn gcn.nasa.govnasa-gcn gcn.nasa.gov Email Notification email improper authorization5.3 Medium
- johnson controls c-cure 9000, victorInsertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000,...8.8 High
- kamsoft zsirep client libraryImproper Server Certificate Validation in ZSIRep Client Library5.3 Medium
- johnson controls easyio neo iomanager and tools installerInclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO...7.3 High
- jumis pro sia jumisUniversal sysadmin credential vulnerability in Jumis9.3 Critical
- johnson controls easyio neo iomanager and tools installerCleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo...8.6 High
- johnson controls easyio neo io manager and tools installerImproper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO...8.6 High
- Show moreLoading…