Skip to content
OpenAdvisories

Archive

10 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /10
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 1465
  15. 1511
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-126187 Public exploit

    React: Unauthenticated Remote Code Execution in React Server Components

    React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code exe…

    react react react-server-dom-webpack react-server-dom-turbopack Ubuntu npm
  • Critical 9.8
    CVE-2026-89324 Public exploit

    Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt

    The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_confi…

    Xtemos Basel Post Types Web / CMS
  • Critical 9.0
    CVE-2026-118383 Public exploit

    Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

    A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpec…

    MongoDB MongoDB Server
  • Critical 9.1
    CVE-2026-121529 Public exploit

    A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 throug…

    Fortinet FortiClientWindows FortiClientMac FortiClientWindowsPAM Network devices
  • Critical 9.8
    CVE-2026-119958 Public exploit

    Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

    Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Critical 9.8
    CVE-2026-121653 Public exploit

    SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker t…

    ivanti Endpoint Manager Network devices
  • Critical 9.1
    CVE-2026-125757 Public exploit

    mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

    mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with a…

    mailcow mailcow-dockerized
  • Critical 10.0
    CVE-2026-76964 Public exploit

    Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

    SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fu…

    SAP SAP NetWeaver AS ABAP (Internet Communication Manager)