Skip to content
OpenAdvisories

Archive

November 2026

Vulnerabilities first published in this month (UTC), newest first.

← October 2026 2026 / November
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12283
  13. 13 
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-124194 Exploited Public exploit

    Microsoft Outlook Spoofing Vulnerability

    Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024
    KEV Nov 10, 2026
  • High 8.8
    CVE-2026-125350 Exploited Public exploit

    Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code insid…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
    KEV Nov 10, 2026
  • Critical 9.8
    CVE-2026-123218 Exploited Public exploit

    IBM Aspera Faspex Authorization Bypass

    IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

    IBM Aspera Faspex
    KEV Nov 9, 2026
  • High 7.5
    CVE-2026-19868 Exploited Public exploit

    An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…

    SonicWall SonicOS Network devices
    KEV Nov 6, 2026
  • Critical 9.8
    CVE-2026-116779 Exploited Public exploit

    FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of …

    signalwire freeswitch
    KEV Nov 9, 2026
  • High 8.1
    CVE-2026-123158 Exploited Public exploit EPSS 19%

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentic…

    OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
    KEV Nov 9, 2026
  • Critical 9.8
    CVE-2026-102895 Exploited

    GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, wh…

    gpustack gpustack gpustack PyPI
    KEV Nov 9, 2026
  • Medium 4.3
    CVE-2026-118527 Exploited

    Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticat…

    ivanti Connect Secure Network devices
    KEV Oct 30, 2026
  • Critical 9.3
    CVE-2026-116606 Exploited Public exploit Scanner template

    Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

    An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modifi…

    Barracuda Networks Barracuda Email Security Gateway (ESG)
    KEV Nov 10, 2026
  • High 8.6
    CVE-2026-111560 Exploited

    OS Command Injection in Barracuda Appliances

    Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the craf…

    Barracuda Networks Barracuda Email Security Gateway (ESG) Barracuda WAF Control Center (WCC) Barracuda Web Application Firewall (WAF)
    KEV Nov 10, 2026