Skip to content
OpenAdvisories

Archive

12 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /12
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 1465
  15. 1512
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-107360 Public exploit

    Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions

    A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument method…

    Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  • Critical 9.8
    CVE-2026-124002 Public exploit

    Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username

    XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua,…

    Copeland XWEB EVO
  • Critical 10.0
    CVE-2026-117551 Public exploit

    Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8

    Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.

    jdownloads.com jDownloads extension for Joomla Web / CMS
  • Critical 9.2
    CVE-2026-127016 Public exploit

    MISP Modules Website: Missing Authorization on External Tool Management Endpoints

    The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application e…

    MISP misp-modules
  • Critical 9.8
    CVE-2026-76954 Public exploit

    An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskSta…

    Synology DiskStation Manager (DSM)