Skip to content
OpenAdvisories

Archive

9 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /9
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12386
  13. 1392
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.0
    CVE-2026-125399 Public exploit

    Fluxion before 6.39 OS Command Injection via Crafted SSID

    Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID …

    FluxionNetwork fluxion
  • High 8.8
    CVE-2026-94434 Public exploit

    OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair

    Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0…

    TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair
  • High 7.3
    CVE-2026-68982 Public exploit

    Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation

    Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitra…

    Apache Software Foundation Apache Airflow
  • High 8.8
    CVE-2026-86829 Public exploit

    Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

    Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the…

    Apache Software Foundation Apache Airflow
  • High 7.3
    CVE-2026-124576 Public exploit

    BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow

    A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resu…