CVEs published in November 2026
7,962 vulnerabilities, 684 critical, 12 exploited.
- progress software kendo ui for angularCross-Site Scripting in Progress Software Kendo UI for Angular5.4 Medium
- progress software kendoreactCross-Site Scripting in Progress Software KendoReact5.4 Medium
- freescout-help-desk freescoutFreeScout: Stored XSS in mailbox signature via same-origin JS upload7.6 High
- progress software kendoreactCross-Site Scripting in Progress Software KendoReact5.4 Medium
- progress software kendo ui for angularCross-Site Scripting in Progress Software Kendo UI for Angular5.4 Medium
- sensiolabs symfonySymfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects6.9 Medium
- progress software progress® telerik® fiddler® everywhereCross-site Scripting in Progress Telerik Fiddler Everywhere7.3 High
- progress software fiddler download & setup skillMissing Integrity Verification in Progress Software Fiddler Download & Setup Skill7.5 High
- snowflake connector for python, connector for python (universal core) +1 moreSQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)8.1 High
- jetbrains phpstormIn JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment...4.4 Medium
- jetbrains phpstormIn JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset...4.3 Medium
- jetbrains toolbox appIn JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a...6.5 Medium
- jetbrains toolbox appIn JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration...7.5 High
- jetbrains pycharmIn JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter...5.5 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via...7.8 High
- jetbrains junie github actionIn JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was...7.4 High
- jetbrains junie github actionIn JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via...3.5 Low
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via...7.0 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS...7.4 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in...5.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON...4.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references...3.3 Low
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories5.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent...3.3 Low
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when...7.1 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported...7.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor...4.7 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible...4.7 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer...7.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted...7.8 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private...8.8 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 code execution was possible in another user's computation via...5.9 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using...7.5 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted...3.6 Low
- jetbrains clionIn JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation...9.6 Critical
- jetbrains clionIn JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson...9.6 Critical
- infiniflow ragflowRAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter5.3 Medium
- sensiolabs symfonySymfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File8.2 High
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 moreAvast sandbox escape via unpreserved COM pathway through Task Scheduler8.8 High
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 moreAvast sandbox escape via arbitrary file write in virtualized environment8.8 High
- checkmk gmbh checkmkPrivilege escalation via unprotected Windows agent data folder6.3 Medium
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 moreAvast WFP stream parser integer underflow causes system crash6.2 Medium
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avast business security, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 moreAvastSvc denial of service via unhandled JsonCpp exceptions in native message handlers6.5 Medium
- langgenius difyDify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints7.2 High
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.3 Low
- 201206030 novelxxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization5.3 Medium
- apache software foundation axis 1.x (eol)Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName9.8 Critical
- hcl aionHCL AION is affected by multiple security vulnerabilities.5.3 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.3 Low
- Show moreLoading…