Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,485 results · Clear filters · Feed
-
High 7.8
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research …
-
High 8.1
IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restriction…
-
High 7.5
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sen…
-
High 8.1
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a…
-
High 8.7
: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, John…
-
High 7.0
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Co…
-
High 7.5
IBM webMethods Integration Server is vulnerable to sensitive information disclousure via admin/server/env API request.
IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.
-
High 7.0
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson…
-
High 8.1
IBM ContextForge MCP Gateway is affected by an improper authentication vulnerability
IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth (authorization_code and client_credentials), bear…
-
High 8.1
Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes
Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid rem…
-
High 7.4
IBM ContextForge MCP Gateway is affected by an information exposure vulnerability
IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configu…
-
High 8.1CVE-2026-124020 Public exploit
Control Web Panel < 1.30.6 Host Header Password Reset Poisoning
Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token ge…
-
High 7.0
Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path
Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configurati…
-
High 8.4
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Cont…
-
High 7.8
A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader c…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses e…
-
High 8.3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined req…
-
High 8.2
AIOHTTP: Unbounded buffering of data received during an upgrade request
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit …
-
High 7.5
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_ch…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does no…
-
High 7.1
Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the tic…
-
High 8.2
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain…
-
High 8.5
- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, an…
-
High 8.6
Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows aut…
-
High 7.5
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 u…
-
High 7.5
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 un…
-
High 7.5
dnspython has excessive memory and CPU use
dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset. An attacker-controlled zone file can supply a larger number…
-
High 8.2
Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /…
-
High 8.3
Budget Board's OIDC login links to an existing local account by email alone, with no email_verified check, enabling account takeover of pre-existing users
Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provi…
-
High 7.1
Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can…
-
High 8.7
BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1…
-
High 8.1
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and…
-
High 7.7
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and…
-
High 7.7
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and…
-
High 7.5
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and…
-
High 8.8
BACnet Stack: MS/TP COBS decode overflow
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same…
-
High 8.7
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-b…
-
High 7.5
AutoMapper: Uncontrolled Recursion with Constructor Parameters
AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper increments type depth only after creating the destination, so recursive mapping performed through constructor parameters occurs before MaxD…