Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
89 results · Clear filters · Feed
-
Critical 9.8CVE-2026-76954 Public exploit
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskSta…
-
High 7.6CVE-2026-65971 Public exploit
Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowi…
-
Critical 9.8CVE-2026-126170 Public exploit
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.…
-
Medium 4.9CVE-2026-63505 Public exploit
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
Medium 5.3CVE-2026-125439 Public exploit
WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.
-
Critical 9.3CVE-2026-112174 Public exploit
Privilege escalation in Enter’s Iperius Backup
Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistent…
-
Critical 9.5CVE-2026-126187 Public exploit
React: Unauthenticated Remote Code Execution in React Server Components
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code exe…
-
Medium 5.4CVE-2026-67176 Public exploit
Chargemap open redirect
Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17.
-
Medium 4.6CVE-2026-67175 Public exploit
Chargemap stored XSS
Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.
-
Critical 9.8CVE-2026-89324 Public exploit
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, …
-
Critical 9.5CVE-2026-118383 Public exploit
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary comp…
-
Critical 9.1CVE-2026-121529 Public exploit
A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 throug…
-
High 7.5CVE-2026-105437 Public exploit
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger…
-
High 7.5CVE-2026-119948 Public exploit
Windows Active Directory Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.
-
Medium 4.9CVE-2026-119905 Public exploit
Windows DNS Spoofing Vulnerability
Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft Outlook Spoofing Vulnerability
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
KEV Nov 10, 2026 -
High 7.0CVE-2026-100204 Public exploit
HEIF Image Extensions Remote Code Execution Vulnerability
Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.
-
High 8.8
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code insid…
KEV Nov 10, 2026 -
High 7.2CVE-2026-105425 Public exploit
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versi…
-
Critical 9.1CVE-2026-125757 Public exploit
mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with a…
-
Medium 5.9CVE-2026-125753 Public exploit
ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints
ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded ba…
-
Critical 10.0CVE-2026-76964 Public exploit
Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fu…
-
High 8.0CVE-2026-125399 Public exploit
Fluxion before 6.39 OS Command Injection via Crafted SSID
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID …
-
Medium 5.3CVE-2026-125394 Public exploit
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and …
-
Medium 5.9CVE-2026-122056 Public exploit
Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service
A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corru…
-
Medium 6.3CVE-2026-56712 Public exploit
Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Co…
-
Critical 10.0CVE-2026-110468 Public exploit
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload ar…
-
Critical 9.3CVE-2026-124079 Public exploit
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability…
-
High 8.8CVE-2026-94434 Public exploit
OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0…
-
Unscored —CVE-2026-123753 Public exploit
Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault,…
-
Critical 10.0CVE-2026-115252 Public exploit
Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users …
-
Unscored —CVE-2026-68982 Public exploit
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitra…
-
Unscored —CVE-2026-86829 Public exploit
Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the…
-
Medium 6.0CVE-2026-92606 Public exploit
TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputer
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus MyComputer: from 0…
-
High 7.3CVE-2026-124576 Public exploit
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resu…
-
Medium 4.8CVE-2026-124552 Public exploit
Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecm…
-
Critical 9.3CVE-2026-124450 Public exploit
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDoc…
-
Unscored —CVE-2026-99273 Public exploit
ksmbd: reserve space for the UTF-16 terminator in stream info
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets …
-
Critical 9.8CVE-2026-121265 Public exploit
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. It…
-
Medium 5.4CVE-2026-122675 Public exploit
WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.