CVEs published in November 2026
7,953 vulnerabilities, 680 critical, 12 exploited.
- pluginus.net foxWordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability5.3 Medium
- elightup meta box – wordpress custom fields frameworkWordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability6.5 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability5.3 Medium
- dataeaseDataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting5.3 Medium
- dataeaseDataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload6.9 Medium
- dataeaseDataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection6.9 Medium
- esengine deepseek-reasonixESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission5.3 Medium
- treeioTreeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields8.6 High
- libexpatlibexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf166.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests5.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items7.1 High
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities7.1 High
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc5.3 Medium
- fraunhoferhhi vvdecFraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo5.7 Medium
- fraunhoferhhi vvdecFraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk6.8 Medium
- fraunhoferhhi vvdecFraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic6.9 Medium
- fraunhoferhhi vvdecFraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting6.9 Medium
- fraunhoferhhi vvdecFraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs5.8 Medium
- fraunhoferhhi vvdecFraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition5.8 Medium
- linuxnet/sched: sch_teql: fix use-after-free on lower qdisc dropNo score
- linuxtun: Require CAP_NET_ADMIN to attach to an ownerless device7.8 High
- linuxksmbd: drain session procfs readers before dropping table referencesNo score
- linuxksmbd: reclaim ended sessions on logoff and expirationNo score
- linuxksmbd: limit sessions on each connectionNo score
- linuxksmbd: hold a connection reference for each session channel7.5 High
- linuxksmbd: defer connection scavenging while session locks are busyNo score
- linuxsmb: client: reject short SESSION_SETUP responsesNo score
- linuxsmb: client: fix fiemap wild read on empty truncated responseNo score
- linuxksmbd: reserve space for the UTF-16 terminator in stream infoNo score
- linuxsmb: client: validate the data area in SMB2_read()No score
- linuxALSA: line6: Clear prev_fbuf on capture buffer releaseNo score
- code-projects food ordering systemSililaWijesinghe Food Ordering System admin exposure of information through directory listing6.9 Medium
- tenda ac19Tenda AC19 saveParentControlInfo heap-based overflow10.0 Critical
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import9.1 Critical
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability5.3 Medium
- openbmb internet of agentsOpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loop5.3 Medium
- crocoblock jetformbuilder – hierarchical selectWordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- magepeople inc. wptravellyWordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability8.8 High
- magepeople inc. wptravellyWordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability8.8 High
- cool plugins formkit liteWordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability5.3 Medium
- stylemixthemes motorsWordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability4.3 Medium
- shahjahan jewel fluent bookingWordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability5.4 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability5.3 Medium
- bakkbone australia floristpressWordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability4.3 Medium
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability5.3 Medium
- pluginus.net active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability5.3 Medium
- leap13 premium blocks – gutenberg blocks for wordpressWordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability5.3 Medium
- villatheme curcyWordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability5.3 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…