CVEs published November 14, 2026
65 CVEs were published on November 14, 2026: 11 critical, 10 high. 1 early warning was posted.
- Published
- 65
- Critical
- 11
- High
- 10
- Medium
- 18
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 35
- Early warnings
- 1
Most affected products
- JSON-XS
- 7
- Duplicate Post
- 3
- Countdown, Coming Soon, Maintenance
- 2
- Email Marketing 4Dem
- 2
- ettercap
- 2
- Flatsome
- 2
- kolkov angular-editor
- 2
- Mereithhh VanBlog
- 2
- TRENDnet TEW-657BRM
- 2
- WP Ultimate CSV Importer
- 2
Early warnings 1
Critical 11
- CVE-2026-129353D-Link DIR-600L unauthenticated stack overflow in authentication.cgiD-Link DIR-600L
- CVE-2026-129352TRENDnet TEW-657BRM stack overflow in upgrade_flash.cgiTRENDnet TEW-657BRM
- CVE-2026-129351TRENDnet TEW-657BRM remote memory corruption in mini_httpdTRENDnet TEW-657BRM
- CVE-2026-129261Kingston FURY CTRL RGB Control Software local system takeover via NTIOLib_X64.sys IOCTLKingston FURY CTRL RGB Control Software
- CVE-2026-129258Tenda AC18 unverified firmware install in upgrade handlerTenda AC18
- CVE-2026-19907Shipo authentication bypass in login cookie verificationShipo
- CVE-2026-120522Cloud Storage Manager for Fluent Forms path traversal file write via Google Drive filenamesfluentwiz Cloud Storage Manager for Fluent Forms – Google D…
- CVE-2026-129433Dokploy command injection in compose backup serviceNamedokploy
- CVE-2026-129255CoolerMaster MASTERPLUS+ local privilege escalation in WinRing0x64.sys driverCoolerMaster MASTERPLUS+
- CVE-2026-129250Edimax BR6478ACV2 buffer overflow in formPPTPSetup web handlerEdimax BR6478ACV2
- CVE-2026-126173AutomatorWP Webhooks unauthenticated password reset in webhook handlerAutomatorWP Webhooks
High 10
- CVE-2026-129456FRRouting remote use-after-free in bgpd tunnel encapsulationfrrouting
- CVE-2026-116753Ninjateam Multi Step for Contact Form 7 stored XSS in multipart field name parameterninjateam Multi Step for Contact Form
- CVE-2026-120687Lightbox & Modal Popup WordPress Plugin FooBox unauthenticated stored XSS in image alt attributesfooplugins Lightbox & Modal Popup WordPress Plugin – FooBox
- CVE-2026-18053LearnDash MemberDash account takeover via IDOR in profile editingLearnDash MemberDash
- CVE-2026-129429india-payroll unauthorized payroll data access in tax regime selectorfrappe india-payroll
- CVE-2026-129431Ettercap out-of-bounds heap read in SOCKS5 dissectorettercap
- CVE-2026-129432Ettercap out-of-bounds heap read in NFS mountd dissectorettercap
- CVE-2026-129427Cervantes stored XSS in avatar upload enables account takeoverCervantesSec cervantes
- CVE-2026-129319Create ECDH private key recovery in elliptic curve key agreementbrowserify create-ecdh
- CVE-2026-124969Optimole Optimize Images arbitrary file deletion via deserialization in commentsOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
Medium, low and unrated 44
- CVE-2015-10149Dancer path traversal and injection via session cookie IDsDancer
- CVE-2026-129447Kroki reflected XSS in DBML SVG endpointyuzutech kroki
- CVE-2026-129267XBackBone cross-site scripting in MediaController getRawByIdsergix44 XBackBone
- CVE-2026-129264sox_ng out-of-bounds write in VOC decoder read_samples_vocsox_ng
- CVE-2026-129262Wubang Five-in-One Safety Production Management Information System unauthenticated file upload in DiyFileUploadWuxi Wubang Security Software Wubang Five-in-One Safety Pro…
- CVE-2026-129260VanBlog file read via path traversal in custom page handlerMereithhh VanBlog
- CVE-2026-127115BuddyForms stored XSS in login form shortcode attributethemekraft BuddyForms
- CVE-2026-110531FV Player stored XSS in popup shortcode attributefoliovision FV Player
- CVE-2026-129259VanBlog cross-site scripting in image upload endpointMereithhh VanBlog
- CVE-2011-10042HTTP Session command injection in memcached session storehttp-session
- CVE-2025-71464Angular Editor cross-site scripting in toggleEditorMode() source viewkolkov angular-editor
- CVE-2025-71465Angular Editor cross-site scripting in refreshView()kolkov angular-editor
- CVE-2026-129428Pulse remote authorization bypass in AI assistant approval APIrcourtman Pulse
- CVE-2026-129430filesharing stored XSS in bundle description markdown linksaxeloz filesharing
- CVE-2026-129254Opixido OCMS cross-site scripting via img parameter in admin TUIOpixido OCMS
- CVE-2026-129115JSON-XS freed memory read in FREEZE encodingJSON-XS
- CVE-2026-129114JSON-XS heap buffer overflow in incremental parserJSON-XS
- CVE-2026-129113JSON-XS denial of service via underflow in incremental parserJSON-XS
- CVE-2026-124541JSON-XS memory leak in decode_str on rejected long stringsJSON-XS
- CVE-2026-124540JSON-XS denial of service via stack exhaustion in decode_tagJSON-XS
- CVE-2026-124539JSON-XS memory leak in decode_hv for malformed objectsJSON-XS
- CVE-2026-124536JSON-XS memory exhaustion in incremental parserJSON-XS
- CVE-2026-129251CloudSchool cross-site scripting in event description handlerhrshadhin CloudSchool
- CVE-2026-129248Akaunting validation bypass in invoice item quantity checksAkaunting
- CVE-2026-129247RuoYi path traversal in code generator file name handlingyangzongzhuan RuoYi
- CVE-2026-18742UX-themes Flatsome stored XSS in custom HTML block attributesUX-themes Flatsome
- CVE-2026-129181Visitor Management System unauthenticated SQL injection in login endpointprojectworlds Visitor Management System
- CVE-2026-126697Quick Page/Post Redirect Plugin backdoor via hidden off-repository update channelQuick Page/Post Redirect Plugin
- CVE-2026-126640WP Ultimate CSV Importer authenticated SQL injection in LifterLMS importWP Ultimate CSV Importer
- CVE-2026-126639WP Ultimate CSV Importer unauthenticated post data disclosure via export filesWP Ultimate CSV Importer
- CVE-2026-124649Lightbox with PhotoSwipe stored XSS in image captions via comment link titlesLightbox with PhotoSwipe
- CVE-2026-123122Checkout Files Upload for WooCommerce stored XSS in checkout file uploadCheckout Files Upload for WooCommerce
- CVE-2026-123046SEOJuice admin account creation via CSRF in REST API filterSEOJuice
- CVE-2026-119258Swipe authentication bypass in login flow allows admin takeoverSwipe
- CVE-2026-118183Duplicate Post publishing restriction bypass in post duplicationDuplicate Post
- CVE-2026-118182Duplicate Post authenticated slug takeover of any readable postDuplicate Post
- CVE-2026-118181Duplicate Post access control bypass in plugin settingsDuplicate Post
- CVE-2026-117490Flatsome authorization bypass in ux_builder_save AJAX actionFlatsome
- CVE-2026-117487Flatsome unauthenticated access to unpublished posts via AJAXFlatsome
- CVE-2026-116528Chargely Free Subscriptions For Woocommernce credential disclosure in REST settings endpointChargely Free Subscriptions For Woocommernce
- CVE-2026-105984Email Marketing 4Dem unauthenticated data deletion in AJAX actionsEmail Marketing 4Dem
- CVE-2026-105983Email Marketing 4Dem unauthenticated settings change in WordPress AJAX routesEmail Marketing 4Dem
- CVE-2026-111034Countdown, Coming Soon, Maintenance post title disclosure in select2Ajax AJAX actionCountdown, Coming Soon, Maintenance
- CVE-2026-111033Countdown, Coming Soon, Maintenance stored XSS in savePost countdown dataCountdown, Coming Soon, Maintenance