CVEs added in
November 2026

Broken Access Control (CWE-862) in Moodle H5P Files

Privilege Escalation (CWE-269) in BuddyForms WordPress

SQL Injection (CWE-89) in PowerSYSTEM Center Report Designer

Incorrect Authorization (CWE-863) in PowerSYSTEM Center

SQL Injection (CWE-89) in FTS3 Web Monitoring /linkinfo

Server-Side Request Forgery (CWE-918) in Kubeflow UI

SSRF (CWE-918) in Kubeflow Pipelines Artifact Route

Missing Authorization (CWE-862) in Kubeflow Pipelines

Command Injection (CWE-78) in AG2 SandboxShellTool

Authorization Bypass (CWE-639) in Rucio Sign-URL API

SQL Injection (CWE-89) in Dolibarr Third-Party Update

Symlink Following (CWE-59) in Code Graph RAG Tools

Authentication Bypass (CWE-287) in OAuthLib Device Flow

Improper Input Validation (CWE-20) in MONAI PydicomReader

Improper Input Validation (CWE-20) in dcmjs DICOM Values

Path Traversal (CWE-22) in Code Graph RAG MCP Server

Sensitive Data Exposure (CWE-200) in OpenEMR Fax Module

Missing Certificate Validation (CWE-295) in FreeSWITCH

Command Injection (CWE-77) in FreeSWITCH SIP REFER Handler

Exposed API Command Execution (CWE-749) in FreeSWITCH

Missing Authorization (CWE-862) in OpenEMR Controller

Missing Authorization (CWE-862) in OpenEMR DORN Module

Cross-Site Request Forgery (CWE-352) in OpenEMR POS

Stored XSS (CWE-79) in OpenEMR Clinical Form Fields

Authorization Bypass (CWE-639) in OpenEMR Documents

SQL Injection (CWE-89) in SuiteCRM Legacy SOAP Portal

SQL Injection (CWE-89) in SuiteCRM Report Query Builder

SQL Injection (CWE-89) in SuiteCRM jjwg_Maps Endpoint

SQL Injection (CWE-89) in SuiteCRM CasesController Action

SQL Injection (CWE-89) in SuiteCRM Revision Handler

SSRF (CWE-918) in SuiteCRM CalendarAccount testConnection

SQL Injection (CWE-89) in SuiteCRM Email Attachments

SQL Injection (CWE-89) in SuiteCRM Project Module API

SQL Injection (CWE-89) in SuiteCRM REST v4 JSON Handler

SQL Injection (CWE-89) in SuiteCRM REST API v4.1 Endpoint

SQL Injection (CWE-89) in SuiteCRM Legacy REST Methods

Path Traversal (CWE-22) in SuiteCRM Upgrade Wizard

SQL Injection (CWE-89) in SuiteCRM Campaign ROI Module

SQL Injection (CWE-89) in SuiteCRM Projects Controller

Missing Edit Authorization (CWE-862) in SuiteCRM API

SSRF (CWE-918) in SuiteCRM External Host Validation

SQL Injection (CWE-89) in SuiteCRM AOR Reports Module

Missing Authentication (CWE-306) in noname Electron Server

SQL Injection (CWE-89) in SuiteCRM AOR Report Generation

Authorization Bypass (CWE-639) in SuiteCRM V8 JSON:API

Improper Authorization (CWE-269) in SuiteCRM V8 API

Improper Authorization (CWE-269) in Immich Shared Albums

Unsafe Deserialization (CWE-502) in PyMoDAQ Components

OS Command Injection (CWE-78) in ntopng Scan Scheduler

Credential Exposure (CWE-200) in OpenHuman Approval Gate

Command Injection (CWE-78) in OpenHuman Agent Harness

Approval Bypass (CWE-862) in OpenHuman Yuanbao Channel

Missing Authentication (CWE-306) in OpenHuman Dictation WS

Authentication Bypass (CWE-288) in OpenHuman Socket.IO

Code Injection (CWE-95) in h5io HDF5 Deserialization

Path Traversal (CWE-22) in GluonTS Archive Extraction

Unsafe Deserialization (CWE-502) in ESPectre Analysis Tools

Missing Authentication (CWE-306) in Metasploit msf-ws

Stored Cross-Site Scripting (CWE-79) in HeyForm Uploads

Path Traversal (CWE-73) in MariaDB Partition Conversion

Auth Bypass (CWE-306) in OpenBMB WebSocket Manager

Cleartext Secret Exposure (CWE-312) in BaSyx Helm Charts

SQL Injection (CWE-89) in Online Book Store admin_edit.php

Authentication Bypass (CWE-287) in AgentScope Service

Incorrect Authorization (CWE-863) in AgentScope Bash Tool

OS Command Injection (CWE-78) in AgentScope MCP API

Cleartext Password Storage (CWE-312) in BaSyx Helm Chart

Code Injection (CWE-94) in DB-GPT CodeAction Handler Path

TLS Verification Bypass (CWE-295) in vault-java-driver

Missing Authorization (CWE-862) in Kyverno Policy Engine

Certificate Validation Bypass (CWE-295) in Kyverno

Authorization Bypass (CWE-862) in Kyverno Mutate Processor

Privilege Escalation (CWE-269) in Kyverno Policies

Authorization Bypass (CWE-269) in Kyverno APICall Fetch

Path Traversal (CWE-22) in Kyverno CEL Resource APIs

Authorization Bypass (CWE-639) in Kyverno Generation

Policy Bypass (CWE-863) in Kyverno Admission Controller

Authorization Bypass (CWE-863) in Kyverno Cleanup Controller

Authorization Bypass (CWE-862) in Kyverno Policies

Privilege Escalation (CWE-269) in Kyverno Policies

Command Injection (CWE-77) in Edimax BR-6208AC /goform/mp

Improper Authorization (CWE-863) in Pocket ID OIDC

SQL Injection (CWE-89) in EmployeeRecruitmentSystem

Sandbox Isolation Failure (CWE-284) in Yuxi Platform

Path Traversal (CWE-22) in Readest Desktop Transfers

Server-Side Request Forgery (CWE-918) in Readest OPDS Proxy

Broken Access Control (CWE-522) in VitaFit Cloud API

Hardcoded Credentials (CWE-798) in VitaFit Android App

Improper Certificate Validation (CWE-295) in VitaFit

Authorization Bypass (CWE-639) in 6valley Social Login

Missing Authorization (CWE-862) in GPUStack API Proxy

Authentication Bypass (CWE-287) in GPUStack API Auth

Missing Authorization (CWE-862) in WebVirtCloud APIs

Path Traversal (CWE-22) in Comfast CF-WR632AX Parser

SSRF (CWE-918) in Dinky Flink Admin Proxy Endpoint

Authorization Bypass (CWE-288) in Traccar Media API

Authorization Bypass (CWE-862) in Telepresence Manager

Session ID Authorization Bypass (CWE-639) in Telepresence

Missing Authentication (CWE-306) in Linksys E5350 Setup Wizard

Missing Authentication (CWE-306) in DeepSeek Harness

OS Command Injection (CWE-78) in Linksys E5350 apply.cgi

OS Command Injection (CWE-78) in Linksys WRT54GL Router

Command Injection (CWE-78) in Linksys WRT54GL CGI

Server-Side Template Injection (CWE-1336) in DataGerry

Missing Authentication (CWE-306) in jt808-server Web API

Missing Authentication (CWE-306) in SharpEmu Debugger

Broken Access Control (CWE-639) in CoopCycle Web API

IDOR (CWE-639) in Stonewuu ai-fusion-video Project APIs

Unvalidated Writes (CWE-822) in Zephyr RTIO Syscalls

Auth Bypass (CWE-287) in Linksys E5600 Login Handler

SQL Injection (CWE-89) in funadmin Frontend List Endpoint

Hard-Coded Credentials (CWE-798) in Qihoo 360 Router M5

OS Command Injection (CWE-78) in Qihoo 360 Timezone Handler

OS Command Injection (CWE-78) in Qihoo 360 D603-2 Devices

SQL Injection (CWE-89) in RosarioSIS StudentSummary.php

Missing Authorization (CWE-862) in emailflare API Keys

Missing Authentication (CWE-306) in Emerson Ovation

SQL Injection (CWE-89) in School-Management-System Search

Authorization Bypass (CWE-863) in node-opcua OPC UA Servers

Command Injection (CWE-78) in Argo CD Image Updater

SQL Injection (CWE-89) in CloudClassroom-PHP faculty

Unsafe Deserialization (CWE-502) in Stanza Lemmatizer

Path Traversal (CWE-22) in Yeti Local File Storage

Path Traversal (CWE-22) in Yeti DFIQ Archive Export

Missing Authentication (CWE-306) in Yeti Audit API

Symlink Following (CWE-59) in isomorphic-git checkout

OS Command Injection (CWE-78) in Network UPS Tools

SQL Injection (CWE-89) in Chamilo LMS Session Search

Authorization Scope Bypass (CWE-863) in traQ OAuth2

Stored Cross-Site Scripting (CWE-79) in traQ Files

CRLF Injection (CWE-93) in OPNsense Service Settings

Missing Authorization Checks (CWE-862) in GeoNetwork Search

AngularJS Template Injection (CWE-1336) in GeoNetwork

Code Injection (CWE-94) in Elo Expression Language

Ruby Code Injection (CWE-94) in Elo Ruby Compiler Backend

Code Injection (CWE-94) in Elo Programmatic AST API

Path Traversal (CWE-22) in gohttpserver /upload Endpoint

OS Command Injection (CWE-78) in im3x Scriptables /sync

Unrestricted File Upload (CWE-434) in Volmarg PMS App

Server-Side Request Forgery (CWE-918) in Label Studio Exports

Authorization Bypass (CWE-639) in LogChimp Post API

Privilege Escalation (CWE-269) in GLPI Account Cloning

Tenant IDOR (CWE-639) in FastBee ProductController

Missing Authentication (CWE-306) in Foxel File APIs

OS Command Injection (CWE-78) in nnn togglex Plugin

Incorrect Authorization (CWE-863) in smart-sso Admin APIs

CSRF File-Write Flaw (CWE-352) in AB Download Manager API

Code Injection (CWE-94) in Ziroom ZHOME Lua Handler

Path Traversal (CWE-22) in Dockhand Stack Env Endpoint

Information Disclosure (CWE-200) in Froxlor API Keys

OS Command Injection (CWE-78) in AzuraCast StereoTool

Code Injection (CWE-94) in AzuraCast Timezone Field

Improper Authentication (CWE-269) in SurrealDB MCP Sessions

Authorization Bypass (CWE-284) in SurrealDB Streaming Engine

Improper Certificate Validation (CWE-295) in FreeRDP

Cross-User Cache Disclosure (CWE-200) in Vert.x WebClient

Unsafe Deserialization (CWE-502) in labbench Data Loading

Command Injection (CWE-78) in Amlogic PPPoE Wrapper

SQL Injection (CWE-89) in psqlODBC Updatable Cursors

SQL Injection (CWE-89) in psqlODBC SQLSpecialColumns

Privilege Escalation (CWE-306) in Rancher Manager RBAC

SQL Injection (CWE-89) in AWS SDK for pandas Iceberg writer

Stack Buffer Overflow (CWE-121) in Kamailio ims_qos_npn

Origin Validation Failure (CWE-346) in kaniko Builds

SSRF (CWE-918) in SUSE Rancher Meta Proxy Endpoint

Incorrect Authorization (CWE-863) in LaraDashboard Settings

Cross-Workspace Auth Bypass (CWE-639) in Jpom SSH Batch

Authorization Bypass (CWE-639) in Jpom Docker Hosts

Authentication Bypass (CWE-287) in HotGo SMS Login

Missing Authentication (CWE-306) in madong-admin SaaS API

Incorrect Authorization (CWE-863) in madong-admin-saas

Path Traversal (CWE-22) in GoFound Database Endpoints

Authorization Bypass (CWE-862) in Camaleon CMS Media

Authorization Bypass (CWE-639) in OpenCSG CSGHub Portal

Path Restriction Bypass (CWE-22) in @fastify/http-proxy

Path Traversal (CWE-22) in @fastify/reply-from Plugin

Code Injection (CWE-94) in XunRuiCMS Mobile Site Directory

Code Injection (CWE-94) in XunRuiCMS Email Templates

SQL Injection (CWE-89) in XunRuiCMS Member Module View

OS Command Injection (CWE-78) in WAVLINK DNS Handler

OS Command Injection (CWE-78) in WAVLINK WireGuard CLI

SQL Injection (CWE-89) in CloudClassroom-PHP viewquery.php

Path Traversal (CWE-22) in Zilla HTTP Filesystem Binding

Path Traversal (CWE-22) in LobeHub Chat File Writing

Missing Authentication (CWE-306) in Network-AI A2AServer

Path Traversal (CWE-22) in Network-AI InputSanitizer

Path Traversal (CWE-23) in Network-AI AgentVCR Module

Path Traversal (CWE-23) in Network-AI FileJobStore

Path Traversal (CWE-22) in Termix-SSH File Manager

OS Command Injection (CWE-78) in WAVLINK WN536AX6-A

OS Command Injection (CWE-78) in WAVLINK WireGuard

OS Command Injection (CWE-78) in WAVLINK WN536AX6-A

OS Command Injection (CWE-78) in WAVLINK WireGuard Handler

OS Command Injection (CWE-78) in WAVLINK WN536AX6-A Web UI

OS Command Injection (CWE-78) in WAVLINK WN553X1-B

Command Injection (CWE-78) in WAVLINK WN553X1-B

Command Injection (CWE-78) in WAVLINK ovpn_file Handler

Code Injection (CWE-94) in Prefab UI Generative Sandbox

OS Command Injection (CWE-78) in WAVLINK OpenVPN CLI

OS Command Injection (CWE-78) in WAVLINK WN701AE Router

OS Command Injection (CWE-78) in WAVLINK WN553X1-B

OS Command Injection (CWE-78) in WAVLINK ioos Service

Path Traversal (CWE-22) in Beta9 Volume Mounting Bug

Path Traversal (CWE-22) in Beta9 Worker File API Service

Build Isolation Escape (CWE-653) in Beta9 Build Workers

OS Command Injection (CWE-78) in WAVLINK WN701AE Web Backend