Skip to content
OpenAdvisories

Archive

5 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /5
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13688
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.7
    CVE-2026-111770 Public exploit

    Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

    The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Se…

    Model Context Protocol typescript-sdk server @modelcontextprotocol/server npm
  • High 8.2
    CVE-2026-77622 Public exploit

    Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

    Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space impleme…

    BishopFox sliver github.com/bishopfox/sliver Go
  • High 7.6
    CVE-2026-34157 Public exploit

    Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

    Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands …

    wailsapp wails github.com/wailsapp/wails/v2 Go
  • High 7.1
    CVE-2026-87008 Public exploit

    Code Graph RAG structural tools follow out-of-root symlinks

    Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies…

    vitali87 code-graph-rag code-graph-rag PyPI
  • High 7.5
    CVE-2026-116567 Public exploit

    FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message…

    signalwire freeswitch
  • High 7.7
    CVE-2026-69137 Public exploit Scanner template

    SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address,…

    Suite CRM SuiteCRM
  • High 8.1
    CVE-2026-123158 Exploited Public exploit EPSS 19%

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentic…

    OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
    KEV Nov 9, 2026
  • High 7.5
    CVE-2026-68524 Public exploit

    Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

    An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. The described vulnerability was discovered independantly twice, with eac…

    Apache Software Foundation Apache OFBiz
  • High 7.5
    CVE-2026-73577 Public exploit

    Apache OFBiz: Unauthenticated path-suffix view authorization bypass

    Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., …

    Apache Software Foundation Apache OFBiz
  • High 8.7
    CVE-2026-123014 Public exploit

    iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker t…

    iTerm2 iTerm2