Skip to content
OpenAdvisories

Archive

6 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /6
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12386
  13. 13434
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.8
    CVE-2026-33050 Public exploit

    GeoNode: OS command injection via uploaded file layer name

    GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute…

    GeoNode GeoNode geonode PyPI
  • High 8.1
    CVE-2026-124040 Public exploit

    CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

    CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…

    CivetWeb CivetWeb ceph civetweb Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-19868 Exploited Public exploit

    An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…

    SonicWall SonicOS Network devices
    KEV Nov 6, 2026
  • Critical 9.8
    CVE-2026-84473 Public exploit

    CVE-2026-84473

    Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentica…

    Kiteworks OwnCloud
  • Critical 9.8
    CVE-2026-90436 Public exploit

    Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

    ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> el…

    Apache Software Foundation Apache Axis 1.x (EOL) axis axis Debian Ubuntu
  • Medium 6.8
    CVE-2026-123618 Public exploit

    ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

    ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactiva…

    abpframework abp
  • Critical 9.8
    CVE-2026-123488 Public exploit Scanner template

    Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint

    Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked sta…

    craftcms cms
  • Medium 4.3
    CVE-2026-92080 Public exploit

    Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.

    TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair
  • Critical 9.1
    CVE-2026-114630 Public exploit

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Critical 10.0
    CVE-2026-118423 Public exploit

    WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

    The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

    Web / CMS
  • Critical 9.8
    CVE-2026-113615 Public exploit

    GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

    The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and o…

    Web / CMS