Skip to content
OpenAdvisories

Archive

11 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /11
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.6
    CVE-2026-65971 Public exploit

    Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path

    Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowi…

    Power-Components livewire-powergrid
  • Critical 9.8
    CVE-2026-126170 Public exploit

    A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.…

    Fortinet FortiManager FortiAnalyzer FortiManager Cloud Network devices
  • Critical 9.8
    CVE-2026-126147 Public exploit

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.…

    Fortinet FortiMail Network devices
  • Critical 9.8
    CVE-2026-126148 Public exploit

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …

    Fortinet FortiMail Network devices
  • Medium 4.9
    CVE-2026-63505 Public exploit

    Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…

    getprobo probo
  • High 8.3
    CVE-2026-105440 Public exploit

    Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authent…

    Extreme Networks Switch Engine (EXOS)
  • High 8.1
    CVE-2026-119618 Public exploit

    Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

    Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine Wolfi
  • Critical 9.1
    CVE-2026-126537 Public exploit

    Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

    The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes…

    Saturday Drive Ninja Forms - File Uploads
  • Medium 5.3
    CVE-2026-125439 Public exploit

    WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.

    Kit Kit (formerly ConvertKit)
  • Critical 10.0
    CVE-2026-78287 Public exploit

    WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.

    STAGGS STAGGS
  • Critical 9.3
    CVE-2026-112174 Public exploit

    Privilege escalation in Enter’s Iperius Backup

    Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistent…

    Enter Iperius Backup
  • High 8.1
    CVE-2026-111190 Public exploit

    The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via…

    Repute InfoSystems ARForms Web / CMS
  • High 7.8
    CVE-2026-126497 Public exploit

    LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage

    LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOf…

    LibreCAD LibreCAD librecad librecad Debian Ubuntu