Skip to content
OpenAdvisories

Archive

6 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /6
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 1462
  15. 15 
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-84473 Public exploit

    CVE-2026-84473

    Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentica…

    Kiteworks OwnCloud
  • Critical 9.8
    CVE-2026-90436 Public exploit

    Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

    ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> el…

    Apache Software Foundation Apache Axis 1.x (EOL) axis axis Debian Ubuntu
  • Critical 9.8
    CVE-2026-123488 Public exploit Scanner template

    Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint

    Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked sta…

    craftcms cms
  • Critical 9.1
    CVE-2026-114630 Public exploit

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 10.0
    CVE-2026-118423 Public exploit

    WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

    The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

    Web / CMS
  • Critical 9.8
    CVE-2026-113615 Public exploit

    GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

    The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and o…

    Web / CMS