Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
32 results · Clear filters · Feed
-
High 7.6CVE-2026-65971 Public exploit
Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowi…
-
High 7.5CVE-2026-105437 Public exploit
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger…
-
High 7.5CVE-2026-119948 Public exploit
Windows Active Directory Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.
-
High 7.0CVE-2026-100204 Public exploit
HEIF Image Extensions Remote Code Execution Vulnerability
Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.
-
High 8.8
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code insid…
KEV Nov 10, 2026 -
High 7.2CVE-2026-105425 Public exploit
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versi…
-
High 8.0CVE-2026-125399 Public exploit
Fluxion before 6.39 OS Command Injection via Crafted SSID
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID …
-
High 8.8CVE-2026-94434 Public exploit
OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0…
-
High 7.3CVE-2026-124576 Public exploit
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resu…
-
High 8.8CVE-2026-33050 Public exploit
GeoNode: OS command injection via uploaded file layer name
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute…
-
High 8.1CVE-2026-124040 Public exploit
CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…
-
High 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…
KEV Nov 6, 2026 -
High 7.7CVE-2026-111770 Public exploit
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Se…
-
High 8.2CVE-2026-77622 Public exploit
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space impleme…
-
High 7.6CVE-2026-34157 Public exploit
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands …
-
High 7.1CVE-2026-87008 Public exploit
Code Graph RAG structural tools follow out-of-root symlinks
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies…
-
High 7.5CVE-2026-116567 Public exploit
FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message…
-
High 7.7
SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address,…
-
High 8.1
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentic…
KEV Nov 9, 2026 -
High 7.5CVE-2026-68524 Public exploit
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. The described vulnerability was discovered independantly twice, with eac…
-
High 7.5CVE-2026-73577 Public exploit
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., …
-
High 8.7CVE-2026-123014 Public exploit
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker t…
-
High 7.7CVE-2026-109518 Public exploit
APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…
-
High 8.1CVE-2026-114550 Public exploit
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to expl…
-
High 7.8CVE-2026-115878 Public exploit
Stanza: RCE via pickle deserialization in the lemmatizer
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trai…
-
High 8.1CVE-2026-54161 Public exploit
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed…
-
High 7.5CVE-2026-115290 Public exploit
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted…
-
High 8.8CVE-2026-107441 Public exploit
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 co…
-
High 7.1CVE-2026-106991 Public exploit
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or st…
-
High 7.5CVE-2026-58882 Public exploit
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could l…
-
High 7.2CVE-2026-120318 Public exploit
Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the…
-
High 8.8CVE-2026-120232 Public exploit
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be…