CVEs published in November 2026
7,957 vulnerabilities, 682 critical, 12 exploited.
- artbees jupiter x coreJupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter5.3 Medium
- picocodes noptin – newsletter, new post notifications & email automationNoptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name5.9 Medium
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 moreLifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer6.4 Medium
- themeisle social slider feed – social media feed & gallery widgetsSocial Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter6.4 Medium
- artbees jupiter x coreJupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter5.9 Medium
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter5.3 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content7.2 High
- artbees jupiter x coreJupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta5.4 Medium
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer7.2 High
- thimpress learnpress – course reviewLearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter6.4 Medium
- rabilal js help desk – ai-powered support & ticketing systemJS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title6.4 Medium
- payever checkout – composable payment gatewaypayever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution9.8 Critical
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value7.2 High
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter6.4 Medium
- gbif integrated publishing toolkitCross-site scripting in Integrated Publishing Toolkit4.8 Medium
- microsoft entra device registrationEntra Device Registration Elevation of Privilege Vulnerability10.0 Critical
- nxp mcuxpresso sdkNXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions6.8 Medium
- nxp mcuxpresso sdkNXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions6.7 Medium
- ibericode mc4wpWordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability5.3 Medium
- wpmu dev smush image compression and optimizationWordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Content Injection vulnerability4.3 Medium
- publishpress revisionsWordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability4.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability4.3 Medium
- chouby polylangWordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability5.4 Medium
- red hat openshift pipelines, builds for red hat openshift, openshift serverless +2 more +4 morePipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount8.8 High
- openbmb internet of agentsOpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection6.9 Medium
- sph engineering ugcsUgCS server HCI authentication bypass with empty credentials9.3 Critical
- urwidUrwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)5.3 Medium
- filegatorFileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files5.9 Medium
- filegatorFileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive5.4 Medium
- ignisda ryotRyot: Cross-tenant collection read via `collectionContents`4.3 Medium
- ignisda ryotRyot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)5.9 Medium
- randombit botanBotan: scrypt V-buffer heap overflow on 32-bit from constructor-accepted parameters4.1 Medium
- randombit botanBotan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn2.1 Low
- open-quantum-safe liboqsliboqs: Uninitialized function-pointer dereference in OQS_KEM_encaps_derand for NTRU KEMs5.3 Medium
- open-quantum-safe liboqsliboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others)5.1 Medium
- open-quantum-safe liboqsliboqs: Heap out-of-bounds read in LMS/HSS signature verification via unvalidated signature length (hss_verify_inc.c:215)5.3 Medium
- chartbrewChartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)4.6 Medium
- chartbrewChartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections9.1 Critical
- chenyme grok2apichenyme grok2api STT Billing voice_ws_handler.go behavioral workflow5.3 Medium
- chartbrewChartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage7.5 High
- chartbrewChartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew9.3 Critical
- chartbrewChartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths8.1 High
- chartbrewChartbrew: Blind NoSQL injection via date variable in embedded chart7.5 High
- chartbrewChartbrew: Cross-tenant project takeover via body.team_id in /project routes8.8 High
- chartbrewChartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens7.5 High
- chartbrewChartbrew: Full account takeover via JWTs accepted under default CB_SECRET9.8 Critical
- chartbrewChartbrew SQL injection in dashboard filter substitution9.8 Critical
- chartbrewChartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)7.0 High
- elixir-grpc grpc serverUnbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server8.2 High
- Show moreLoading…