CVEs published November 10, 2026

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component.

SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server.

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component.

A vulnerability has been found in D-Link M60 1.12.B01.

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections.

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations.

SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality.

A vulnerability that could allow an attacker to compromise a system.

SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality.

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality.

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with…

INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in…

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when…

Partial String Comparison Vulnerability in HiRDB.

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality.

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions.

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal.

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests.

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits…

A vulnerability that could allow an attacker to gain unauthorized access.

A vulnerability to perform a privilege escalation attack on the server as a non-admin user.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.

Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check.

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data.

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier…

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint.

UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux.

UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux.

Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows.

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the…

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests.

Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux.

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware.

Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware.

Stack-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware.

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7.

An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions.

Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets.

Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping…

Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field.

Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation.

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes.

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote…

A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes.

UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux.

Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux.

Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux.

Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types.

Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption.

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality.

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete.

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete.

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete.

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete.

SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests.

Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service.

Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application.

An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting.

The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content.

An unauthenticated remote attacker can perform a DoS in the backends backup creation function.

Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length.

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments.

An API key is hardcoded and retrievable from the GV-Face package.

SAP Host Agent does not sufficiently validate certain inputs.

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...).

SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions.

SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests.

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests.

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests.

SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input.

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via…

SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests.

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling.

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function.

A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control.

Insecure Temporary File Vulnerability in Hitachi Dynamic Link Manager for AIX (for markets outside Japan) and Hitachi Dynamic Link Manager EX for AIX (for the Japanese market).

Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows.

A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4.

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0.

Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor.

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field…

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all…

A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution.

A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution.

A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution.

A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution.

A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution.

Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter.

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and…

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators.

SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality.

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware.

An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory…

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of…

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the…

An authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers.

Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market).

Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux.

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name,…

A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider.

A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution.

The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation.

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.

Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.

MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer.

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by…

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission…

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters.

DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body.

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET…

DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values.

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings.

SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests.

SAP NetWeaver Application Server for ABAP does not properly validate certain input values.

SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information.

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a…

Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without…

A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0.

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package.

An API key is hardcoded and retrievable from the GV-Cloud application package.

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package.

An API key is hardcoded and retrievable from the GV-Access package.

The RSA cryptographic key material, including a private key and public key, is embedded within the application package.

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS.

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data.

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially…

SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application.

Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data.

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a…

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and…

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers.

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode.

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs.

MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying…

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys.

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command.

Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed.

MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels.

The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api.

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control.

An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to…

An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts.

The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash.

langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to…

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters.

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint.

Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py.

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files…

A vulnerability was determined in D-Link DCS-6501LH 3.03.02.

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable…

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS…

A high privileged remote attacker can upload arbitrary files to a guessable location.

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries.

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection.

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery.

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality.

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared…

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check.

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks.

Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via…

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0.

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0.

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components.

The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources.

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions.

A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a.

Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values.

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices().

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be…

The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls…

The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and…

Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete.

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own…