Skip to content
OpenAdvisories

Archive

5 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /5
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 1465
  15. 1512
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-116779 Exploited Public exploit

    FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of …

    signalwire freeswitch
    KEV Nov 9, 2026
  • Critical 9.8
    CVE-2026-83542 Public exploit

    Apache OFBiz: Unauthenticated RCE via login-page widget injection

    Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overridin…

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2026-117691 Public exploit

    Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

    A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An a…

    Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.9
  • Critical 9.8
    CVE-2026-100109 Public exploit

    Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

    The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…

    Web / CMS
  • Critical 9.4
    CVE-2026-123025 Public exploit

    An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-…

    opnsense os-acme-client