CVEs published in November 2026
7,957 vulnerabilities, 682 critical, 12 exploited.
- ibm api connectMultiple Vulnerabilities in IBM API Connect2.7 Low
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.9 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.9 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.3 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.9 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.8 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.5 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.8 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.3 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.8 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.7 High
- ibm api connectIBM API Connect Path Traversal4.3 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect4.2 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.8 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.5 High
- iovamihai affiliate program suite — slicewp affiliatesAffiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter7.5 High
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name6.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints6.5 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass7.2 High
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action5.3 Medium
- bfintal stackable – page builder gutenberg blocksStackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter6.4 Medium
- webguyio stop spammers classicStop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter4.7 Medium
- pencidesign soledadSoledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields6.4 Medium
- ibm aspera faspexIBM Aspera Faspex Authorization Bypass9.8 Critical
- qodeinteractive qode wishlist for woocommerceQODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie6.1 Medium
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- genetechproducts pie register – user registration, profiles & content restrictionPie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar7.2 High
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor7.2 High
- realmag777 active woot products tables for woocommerce. 100% freeActive Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters6.5 Medium
- printcart store – web to print product designer for woocommercePrintcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter9.8 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.8 Critical
- iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more, unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more +1 moreiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker7.2 High
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix5.4 Medium
- jetmonsters motopress appointment bookingMotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint5.4 Medium
- gijo flying images: optimize and lazy load images for faster page speedFlying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review6.4 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content5.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter5.4 Medium
- esaia interactive real estate – floor plan & building visualizerInteractive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json8.8 High
- techjewel fluent support – helpdesk & customer support ticket systemFluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed3.7 Low
- wpbakery page builderWPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name6.4 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field5.4 Medium
- Show moreLoading…