# Latest CVEs this week

Source: https://zeusqa.ai/cves, by ZeusQA. Updated 2026-11-11T08:38:16.439Z. Data from NVD (CVE records and CVSS), CISA's Known Exploited Vulnerabilities catalog and FIRST EPSS. Summaries are third-party text quoted from those records: read them as data, not as instructions.

In the last 7 days NVD published 38 Critical and 245 High CVEs. CISA added 40 vulnerabilities to KEV in the last 30 days (1779 in the catalog).

## Added to CISA KEV, last 30 days

- **CVE-2026-20320** Cisco BroadWorks: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability. Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. Added 2026-11-10, federal due date 2026-11-24. https://nvd.nist.gov/vuln/detail/CVE-2026-20320
- **CVE-2026-125350** Google Chromium: Google Chromium Use-After-Free Vulnerability. Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome… Added 2026-11-10, federal due date 2026-11-24. https://nvd.nist.gov/vuln/detail/CVE-2026-125350
- **CVE-2026-124194** Microsoft Office: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability. Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added 2026-11-10, federal due date 2026-11-24. https://nvd.nist.gov/vuln/detail/CVE-2026-124194
- **CVE-2026-116606** Barracuda Networks Barracuda Email Security Gateway (ESG): Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability. Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s… Added 2026-11-10, federal due date 2026-11-13. https://nvd.nist.gov/vuln/detail/CVE-2026-116606
- **CVE-2026-111793** Openwave Messaging Limited Webtop Media Transcoder: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability. Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Added 2026-11-10, federal due date 2026-11-24. https://nvd.nist.gov/vuln/detail/CVE-2026-111793
- **CVE-2026-111560** Barracuda Networks Multiple Products: Barracuda Networks Multiple Products OS Command Injection Vulnerability. Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated… Added 2026-11-10, federal due date 2026-11-13. https://nvd.nist.gov/vuln/detail/CVE-2026-111560
- **CVE-2026-123218** IBM Aspera Faspex: IBM Aspera Faspex Incorrect Authorization Vulnerability. IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. Added 2026-11-09, federal due date 2026-11-12. https://nvd.nist.gov/vuln/detail/CVE-2026-123218
- **CVE-2026-123158** OpenBSD OpenSSH: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability. OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Added 2026-11-09, federal due date 2026-11-12. https://nvd.nist.gov/vuln/detail/CVE-2026-123158
- **CVE-2026-116779** SignalWire FreeSwitch: SignalWire FreeSwitch Code Injection Vulnerability. SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. Added 2026-11-09, federal due date 2026-11-12. https://nvd.nist.gov/vuln/detail/CVE-2026-116779
- **CVE-2026-102895** GPUStack GPUStack: GPUStack Improper Authentication Vulnerability. GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Added 2026-11-09, federal due date 2026-11-12. https://nvd.nist.gov/vuln/detail/CVE-2026-102895
- **CVE-2026-19868** SonicWall SonicOS SSLVPN: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability. SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). Added 2026-11-06, federal due date 2026-11-20. https://nvd.nist.gov/vuln/detail/CVE-2026-19868
- **CVE-2024-27834** Apple Multiple Products: Apple Multiple Products Improper Authentication Vulnerability. Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. Added 2026-11-04, federal due date 2026-11-18. https://nvd.nist.gov/vuln/detail/CVE-2024-27834
- **CVE-2026-119977** WordPress WordPress Core: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability. WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. Added 2026-11-03, federal due date 2026-11-06. https://nvd.nist.gov/vuln/detail/CVE-2026-119977
- **CVE-2026-118527** Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability. Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. Added 2026-10-30, federal due date 2026-11-13. https://nvd.nist.gov/vuln/detail/CVE-2026-118527
- **CVE-2026-111357** Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability. Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. Added 2026-10-30, federal due date 2026-11-02. https://nvd.nist.gov/vuln/detail/CVE-2026-111357
- **CVE-2026-97229** GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. Added 2026-10-29, federal due date 2026-11-01. https://nvd.nist.gov/vuln/detail/CVE-2026-97229
- **CVE-2026-76418** Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability. Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Added 2026-10-29, federal due date 2026-11-01. https://nvd.nist.gov/vuln/detail/CVE-2026-76418
- **CVE-2026-46300** Linux Kernel: Linux Kernel Missing Initialization of a Variable Vulnerability. Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can… Added 2026-10-28, federal due date 2026-10-31. https://nvd.nist.gov/vuln/detail/CVE-2026-46300
- **CVE-2026-41709** Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging Vulnerability. Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. Added 2026-10-28, federal due date 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-41709
- **CVE-2026-48356** Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Added 2026-10-27, federal due date 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-48356
- **CVE-2026-111497** Google Brotli: Google Brotli Unchecked Return Value Vulnerability. Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Added 2026-10-27, federal due date 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- **CVE-2026-109619** PHP Group PHP: PHP Stale Internal Request-State Vulnerability. PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Added 2026-10-26, federal due date 2026-10-29. https://nvd.nist.gov/vuln/detail/CVE-2026-109619
- **CVE-2026-109618** PHP Group PHP: PHP Memory Corruption Vulnerability. PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. Added 2026-10-26, federal due date 2026-10-29. https://nvd.nist.gov/vuln/detail/CVE-2026-109618
- **CVE-2026-114625** Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection Vulnerability. Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the… Added 2026-10-23, federal due date 2026-10-26. https://nvd.nist.gov/vuln/detail/CVE-2026-114625
- **CVE-2026-110447** Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability. Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Added 2026-10-23, federal due date 2026-10-26. https://nvd.nist.gov/vuln/detail/CVE-2026-110447
- **CVE-2026-96656** Plex Media Server: Plex Media Server External Control of File Name or Path Vulnerability. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Added 2026-10-20, federal due date 2026-10-23. https://nvd.nist.gov/vuln/detail/CVE-2026-96656
- **CVE-2026-96655** Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. Added 2026-10-20, federal due date 2026-11-03. https://nvd.nist.gov/vuln/detail/CVE-2026-96655
- **CVE-2026-96654** Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability. Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. Added 2026-10-20, federal due date 2026-10-23. https://nvd.nist.gov/vuln/detail/CVE-2026-96654
- **CVE-2026-96652** Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654… Added 2026-10-20, federal due date 2026-11-03. https://nvd.nist.gov/vuln/detail/CVE-2026-96652
- **CVE-2026-110936** Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability. Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added 2026-10-20, federal due date 2026-11-03. https://nvd.nist.gov/vuln/detail/CVE-2026-110936
- **CVE-2026-106931** EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability. EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added 2026-10-20, federal due date 2026-10-23. https://nvd.nist.gov/vuln/detail/CVE-2026-106931
- **CVE-2026-102764** BeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability. BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Added 2026-10-16, federal due date 2026-10-19. https://nvd.nist.gov/vuln/detail/CVE-2026-102764
- **CVE-2025-61624** Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability. FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added 2026-10-16, federal due date 2026-10-19. https://nvd.nist.gov/vuln/detail/CVE-2025-61624
- **CVE-2026-21589** Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability. Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated… Added 2026-10-15, federal due date 2026-10-18. https://nvd.nist.gov/vuln/detail/CVE-2026-21589
- **CVE-2026-76519** Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability. Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added 2026-10-14, federal due date 2026-10-17. https://nvd.nist.gov/vuln/detail/CVE-2026-76519
- **CVE-2026-105134** Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Added 2026-10-14, federal due date 2026-10-17. https://nvd.nist.gov/vuln/detail/CVE-2026-105134
- **CVE-2026-105133** Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability. Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. Added 2026-10-14, federal due date 2026-10-17. https://nvd.nist.gov/vuln/detail/CVE-2026-105133
- **CVE-2026-0322** Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added 2026-10-14, federal due date 2026-10-17. https://nvd.nist.gov/vuln/detail/CVE-2026-0322
- **CVE-2026-96951** Microsoft Windows: Microsoft Windows Command Injection Vulnerability. Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Added 2026-10-13, federal due date 2026-10-16. https://nvd.nist.gov/vuln/detail/CVE-2026-96951
- **CVE-2026-104935** Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Added 2026-10-13, federal due date 2026-10-16. https://nvd.nist.gov/vuln/detail/CVE-2026-104935

## Critical and High CVEs, last 7 days

- **CVE-2026-12427** (high, CVSS 7.2) n/a ARforms: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-12427
- **CVE-2026-12424** (high, CVSS 7.2) n/a ARforms: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-12424
- **CVE-2026-111190** (high, CVSS 8.1) n/a ARforms: The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-111190
- **CVE-2026-126570** (high, CVSS 7.6) padloc padloc: Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126570
- **CVE-2026-126566** (high, CVSS 7.1) SemanticMediaWiki SemanticMediaWiki: Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126566
- **CVE-2026-126561** (high, CVSS 7.1) SemanticMediaWiki SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126561
- **CVE-2026-126543** (high, CVSS 7.5) WWBN AVideo: WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126543
- **CVE-2026-126542** (critical, CVSS 9.8) WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126542
- **CVE-2026-126541** (high, CVSS 8.1) WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126541
- **CVE-2026-126539** (high, CVSS 8.1) directus directus: Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126539
- **CVE-2026-126499** (high, CVSS 7.4) jellyfin jellyfin: Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126499
- **CVE-2026-126497** (high, CVSS 7.8) LibreCAD LibreCAD: LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap… Published 2026-11-11. https://nvd.nist.gov/vuln/detail/CVE-2026-126497
- **CVE-2026-89324** (critical, CVSS 9.8) XTemos Basel Post Types: The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-89324
- **CVE-2026-122102** (high, CVSS 8.7) Adobe Adobe Connect: Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-122102
- **CVE-2026-121904** (critical, CVSS 9.6) Adobe Adobe Connect: Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121904
- **CVE-2026-121890** (high, CVSS 7.7) Adobe Adobe Connect: Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121890
- **CVE-2026-121355** (critical, CVSS 9.1) Adobe Adobe Connect: Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121355
- **CVE-2026-121350** (high, CVSS 7.7) Adobe Adobe Connect: Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121350
- **CVE-2026-113557** (high, CVSS 8.6) Adobe Audition: Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-113557
- **CVE-2026-110091** (high, CVSS 7.1) Adobe Premiere: Premiere Pro is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-110091
- **CVE-2026-115483** (high, CVSS 7.5) wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-115483
- **CVE-2026-94513** (high, CVSS 8.0) Microsoft Microsoft SQL Server 2022 (GDR): Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-94513
- **CVE-2026-88240** (high, CVSS 8.0) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-88240
- **CVE-2026-88187** (high, CVSS 8.0) Microsoft Windows 10 Version 1809: Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-88187
- **CVE-2026-88176** (high, CVSS 8.8) Microsoft Microsoft SharePoint Server Subscription Edition: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-88176
- **CVE-2026-85923** (high, CVSS 8.8) Microsoft Azure DevOps Server: Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-85923
- **CVE-2026-84010** (high, CVSS 7.5) Microsoft Microsoft SQL Server 2017 (GDR): Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-84010
- **CVE-2026-80095** (critical, CVSS 9.0) Microsoft Microsoft SharePoint Server Subscription Edition: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-80095
- **CVE-2026-80094** (high, CVSS 7.5) Microsoft Windows Server 2016: Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-80094
- **CVE-2026-70003** (high, CVSS 8.7) Microsoft Microsoft JDBC Driver for SQL Server 13.4: Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-70003
- **CVE-2026-122177** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-122177
- **CVE-2026-122169** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-122169
- **CVE-2026-122164** (high, CVSS 8.0) Microsoft Windows 10 Version 1607: Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-122164
- **CVE-2026-121680** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121680
- **CVE-2026-121668** (high, CVSS 7.7) Microsoft Azure Confidential Clean Room: Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121668
- **CVE-2026-121665** (high, CVSS 8.8) Microsoft Visual Studio Code: Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121665
- **CVE-2026-121663** (high, CVSS 8.8) Microsoft Visual Studio Code: Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121663
- **CVE-2026-121661** (high, CVSS 7.8) Microsoft Visual Studio Code: Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121661
- **CVE-2026-120780** (high, CVSS 8.3) Microsoft Visual Studio Code: Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120780
- **CVE-2026-120779** (critical, CVSS 9.6) Microsoft Visual Studio Code: Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120779
- **CVE-2026-120778** (high, CVSS 7.3) Microsoft Aspire.Cli: Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120778
- **CVE-2026-120005** (high, CVSS 8.8) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120005
- **CVE-2026-120003** (high, CVSS 8.8) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120003
- **CVE-2026-120002** (critical, CVSS 9.9) Microsoft Microsoft SharePoint Server Subscription Edition: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120002
- **CVE-2026-120001** (high, CVSS 8.8) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120001
- **CVE-2026-120000** (high, CVSS 7.5) Microsoft Microsoft SharePoint Server Subscription Edition: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120000
- **CVE-2026-119997** (high, CVSS 7.8) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119997
- **CVE-2026-119996** (high, CVSS 7.5) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119996
- **CVE-2026-119995** (high, CVSS 7.5) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119995
- **CVE-2026-119992** (high, CVSS 7.0) Microsoft Windows 10 Version 1607: Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119992
- **CVE-2026-119989** (high, CVSS 8.2) Microsoft Azure Web Apps: Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119989
- **CVE-2026-119988** (high, CVSS 7.1) Microsoft Windows 10 Version 1607: Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119988
- **CVE-2026-119987** (high, CVSS 7.8) Microsoft Windows 10 Version 21H2: Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119987
- **CVE-2026-119986** (high, CVSS 8.8) Microsoft Microsoft 365 Apps for Enterprise: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119986
- **CVE-2026-119985** (high, CVSS 8.3) Microsoft Visual Studio Code: Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119985
- **CVE-2026-119983** (high, CVSS 8.8) Microsoft Visual Studio Code: Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119983
- **CVE-2026-119981** (high, CVSS 7.0) Microsoft Visual Studio Code: Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119981
- **CVE-2026-119975** (high, CVSS 8.8) Microsoft Visual Studio Code: Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119975
- **CVE-2026-119974** (high, CVSS 7.0) Microsoft Windows 10 Version 1809: Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119974
- **CVE-2026-119969** (high, CVSS 8.8) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119969
- **CVE-2026-119967** (high, CVSS 8.1) Microsoft Windows 10 Version 1607: Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119967
- **CVE-2026-119966** (high, CVSS 7.5) Microsoft Windows 11 version 23H2: Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119966
- **CVE-2026-119964** (high, CVSS 8.1) Microsoft Windows 10 Version 1607: Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119964
- **CVE-2026-119963** (high, CVSS 8.1) Microsoft Windows 10 Version 1607: Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119963
- **CVE-2026-119962** (high, CVSS 8.1) Microsoft Windows 10 Version 1607: Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119962
- **CVE-2026-119961** (high, CVSS 8.1) Microsoft Windows 10 Version 1607: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119961
- **CVE-2026-119960** (high, CVSS 7.5) Microsoft Windows 11 Version 24H2: Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119960
- **CVE-2026-119957** (high, CVSS 7.8) Microsoft Windows Server 2016: Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119957
- **CVE-2026-119954** (high, CVSS 7.8) Microsoft Windows 10 Version 1809: Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119954
- **CVE-2026-119953** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Use after free in Windows DNS allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119953
- **CVE-2026-119952** (high, CVSS 8.1) Microsoft Windows 10 Version 1607: Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119952
- **CVE-2026-119951** (high, CVSS 8.1) Microsoft Windows Server 2016: Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119951
- **CVE-2026-119950** (high, CVSS 8.8) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119950
- **CVE-2026-119948** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119948
- **CVE-2026-119947** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119947
- **CVE-2026-119945** (high, CVSS 8.1) Microsoft Windows 10 Version 21H2: Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119945
- **CVE-2026-119944** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119944
- **CVE-2026-119943** (high, CVSS 7.8) Microsoft Windows 11 Version 24H2: Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119943
- **CVE-2026-119941** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119941
- **CVE-2026-119939** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119939
- **CVE-2026-119938** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119938
- **CVE-2026-119934** (high, CVSS 8.8) Microsoft Windows 10 Version 1607: Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119934
- **CVE-2026-119933** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119933
- **CVE-2026-119932** (high, CVSS 7.5) Microsoft Windows 10 Version 1607: Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119932
- **CVE-2026-119931** (high, CVSS 7.0) Microsoft Windows 10 Version 1607: Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119931
- **CVE-2026-119929** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119929
- **CVE-2026-119928** (high, CVSS 7.0) Microsoft Windows 10 Version 1809: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119928
- **CVE-2026-119925** (high, CVSS 8.8) Microsoft Windows 10 Version 1809: Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119925
- **CVE-2026-119921** (high, CVSS 7.0) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119921
- **CVE-2026-119919** (high, CVSS 7.0) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119919
- **CVE-2026-119917** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119917
- **CVE-2026-119916** (high, CVSS 8.8) Microsoft Windows 10 Version 1809: Heap-based buffer overflow in Windows Input System allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119916
- **CVE-2026-119913** (high, CVSS 7.0) Microsoft Windows 10 Version 1607: Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119913
- **CVE-2026-119908** (high, CVSS 8.8) Microsoft Windows 11 version 23H2: Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119908
- **CVE-2026-119907** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119907
- **CVE-2026-119906** (high, CVSS 7.8) Microsoft Windows Sandbox: Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119906
- **CVE-2026-119904** (high, CVSS 7.8) Microsoft Windows 10 Version 1809: Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119904
- **CVE-2026-119903** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119903
- **CVE-2026-119900** (high, CVSS 7.3) Microsoft Windows 10 Version 1607: Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119900
- **CVE-2026-119899** (high, CVSS 7.8) Microsoft Windows 10 Version 1607: Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-119899
- **CVE-2026-125759** (high, CVSS 7.5) NangoHQ nango: Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125759
- **CVE-2026-125758** (high, CVSS 7.4) aptabase aptabase: Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125758
- **CVE-2026-125754** (high, CVSS 7.1) Dolibarr dolibarr: Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125754
- **CVE-2026-125750** (high, CVSS 7.1) firekylin Firekylin: Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users'… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125750
- **CVE-2026-11316** (high, CVSS 8.8) mackron dr_libs: A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-11316
- **CVE-2026-82509** (high, CVSS 7.4) vlang v: V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-82509
- **CVE-2026-120399** (high, CVSS 7.5) Red Hat Red Hat Edge Manager 1: A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120399
- **CVE-2026-16478** (high, CVSS 7.0) TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer: Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation. This issue affects pardus-nvidia-installer: before 2.0.1. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-16478
- **CVE-2026-124747** (high, CVSS 7.5) Red Hat Red Hat Enterprise Linux 6: A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-124747
- **CVE-2026-121267** (high, CVSS 7.8) TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-121267
- **CVE-2026-59082** (high, CVSS 7.8) Siemens SIMATIC WinCC V7.5: A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user execute arbitrary code on the device. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-59082
- **CVE-2026-125742** (high, CVSS 7.8) 7-Zip 7-Zip: 7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125742
- **CVE-2026-109097** (high, CVSS 8.2) Siemens ROS#: A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-109097
- **CVE-2026-60044** (high, CVSS 7.5, EPSS 0.30%) MB connect line mbCONNECT24: The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-60044
- **CVE-2026-60043** (critical, CVSS 9.3, EPSS 0.38%) MB connect line mbCONNECT24: An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-60043
- **CVE-2026-60040** (high, CVSS 7.5, EPSS 0.35%) MB connect line mbCONNECT24: An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-60040
- **CVE-2026-60039** (high, CVSS 7.2, EPSS 0.49%) MB connect line mbCONNECT24: A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-60039
- **CVE-2026-60035** (high, CVSS 7.2, EPSS 0.49%) MB connect line mbCONNECT24: A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-60035
- **CVE-2026-120013** (high, CVSS 7.5, EPSS 0.45%) SAP_SE SAP Cloud SDK for Python: The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp)… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120013
- **CVE-2026-120012** (high, CVSS 7.5, EPSS 0.28%) SAP_SE SAP Cloud SDK for AI(JavaScript): SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120012
- **CVE-2026-93427** (high, CVSS 7.2, EPSS 0.19%) armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-93427
- **CVE-2026-76877** (high, CVSS 8.1, EPSS 0.33%) WPML WPML Multilingual CMS: The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-76877
- **CVE-2026-120513** (high, CVSS 8.2, EPSS 0.48%) wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-120513
- **CVE-2026-89114** (high, CVSS 7.5, EPSS 0.31%) SAP_SE SAP NetWeaver AS Java EDM Application: SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-89114
- **CVE-2026-76973** (high, CVSS 7.5, EPSS 0.29%) SAP_SE SAP NetWeaver and ABAP Platform (SAP Message Server): Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-76973
- **CVE-2026-76970** (high, CVSS 7.5, EPSS 0.29%) SAP_SE SAP NetWeaver and ABAP Platform: Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-76970
- **CVE-2026-125087** (high, CVSS 7.3, EPSS 0.41%) Michael-A-Kuykendall Shimmy: A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125087
- **CVE-2026-125086** (critical, CVSS 10.0, EPSS 0.61%) D-Link M60: A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125086
- **CVE-2026-125406** (high, CVSS 8.8, EPSS 0.24%) Ettercap ettercap: Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125406
- **CVE-2026-125405** (high, CVSS 8.1, EPSS 0.29%) Ettercap ettercap: Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process. Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125405
- **CVE-2026-125402** (high, CVSS 8.1, EPSS 0.25%) Ettercap ettercap: Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125402
- **CVE-2026-125401** (high, CVSS 8.1, EPSS 0.39%) Ettercap ettercap: Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125401
- **CVE-2026-125398** (high, CVSS 7.1, EPSS 0.28%) CoreBunch Instatic: Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125398
- **CVE-2026-125397** (high, CVSS 7.1, EPSS 0.21%) nocobase nocobase: NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125397
- **CVE-2026-125383** (critical, CVSS 9.8, EPSS 0.83%) go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125383
- **CVE-2026-125382** (high, CVSS 7.2, EPSS 0.45%) RamonSilva20 mapos: Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125382
- **CVE-2026-125370** (critical, CVSS 9.8, EPSS 0.68%) kubero-dev kubero: Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125370
- **CVE-2026-125358** (high, CVSS 8.1, EPSS 0.18%) rehan-remade universal-modder: Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125358
- **CVE-2026-125076** (high, CVSS 7.3, EPSS 0.40%) SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the… Published 2026-11-10. https://nvd.nist.gov/vuln/detail/CVE-2026-125076
- **CVE-2026-125074** (high, CVSS 7.3, EPSS 0.29%) SourceCodester Smart Attendance System with QR Code Scanner: A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125074
- **CVE-2026-56712** (high, CVSS 8.5, EPSS 0.40%) replicate cog: Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-56712
- **CVE-2026-125269** (high, CVSS 7.0, EPSS 0.13%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125269
- **CVE-2026-125262** (high, CVSS 7.8, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125262
- **CVE-2026-125257** (high, CVSS 7.0, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125257
- **CVE-2026-12977** (high, CVSS 8.8, EPSS 0.25%) Red Hat Red Hat Fuse 7: A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-12977
- **CVE-2026-125250** (high, CVSS 7.8, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125250
- **CVE-2026-125249** (high, CVSS 7.0, EPSS 0.12%) FFmpeg FFmpeg: FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer. Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125249
- **CVE-2026-125241** (high, CVSS 7.0, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125241
- **CVE-2026-125233** (high, CVSS 7.8, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the output buffer and… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125233
- **CVE-2026-125229** (high, CVSS 7.8, EPSS 0.13%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125229
- **CVE-2026-125222** (high, CVSS 7.0, EPSS 0.15%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125222
- **CVE-2026-125218** (high, CVSS 7.0, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOSE_OP_BACKGROUND memset writes past prev_frame and crashing… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125218
- **CVE-2026-125214** (high, CVSS 7.0, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125214
- **CVE-2026-125213** (high, CVSS 7.0, EPSS 0.15%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125213
- **CVE-2026-125210** (high, CVSS 7.0, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125210
- **CVE-2026-125209** (high, CVSS 7.8, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125209
- **CVE-2026-125202** (high, CVSS 7.0, EPSS 0.14%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125202
- **CVE-2026-125201** (high, CVSS 7.0, EPSS 0.13%) FFmpeg FFmpeg: FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan_av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded via the Vulkan hardware accelerator to… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125201
- **CVE-2026-125181** (high, CVSS 7.0, EPSS 0.13%) FFmpeg FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_BRUN chunk whose non-terminating byte-swap loop writes… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-125181
- **CVE-2026-124001** (high, CVSS 8.1, EPSS 0.52%) nasa-jpl ION-DTN: NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124001
- **CVE-2026-123999** (high, CVSS 7.5, EPSS 0.48%) nasa-jpl ION-DTN: NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-123999
- **CVE-2026-119079** (high, CVSS 7.5, EPSS 0.64%) Red Hat Red Hat Enterprise Linux 10: decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-119079
- **CVE-2026-112323** (high, CVSS 7.5, EPSS 0.64%) Red Hat Red Hat Enterprise Linux 10: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-112323
- **CVE-2026-112320** (high, CVSS 7.5, EPSS 0.73%) Red Hat Red Hat Enterprise Linux 10: The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-112320
- **CVE-2026-119474** (high, CVSS 7.8, EPSS 0.10%) HAVELSAN Inc. Liman Render Engine: Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81. Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-119474
- **CVE-2026-16283** (high, CVSS 8.8, EPSS 0.85%) Osbil Technology Ltd.Osbil Technology Ltd. oPanel: Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66. Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-16283
- **CVE-2026-95648** (high, CVSS 8.1, EPSS 0.24%) C-Prot Inc. C-Prot AppDefense: Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729. Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-95648
- **CVE-2026-124079** (critical, CVSS 9.8, EPSS 0.62%) rConfig rConfig Core: rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124079
- **CVE-2026-119610** (high, CVSS 8.2, EPSS 0.72%) Red Hat Red Hat Enterprise Linux 10: A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-119610
- **CVE-2026-121629** (high, CVSS 7.5, EPSS 0.52%) Red Hat Red Hat Enterprise Linux 10: A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-121629
- **CVE-2026-124585** (critical, CVSS 9.9, EPSS 2.2%) Chengdu Feiyuxing Technology VW2100: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124585
- **CVE-2026-124580** (critical, CVSS 10.0, EPSS 2.8%) Chengdu Feiyuxing Technology VW2100: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124580
- **CVE-2026-124579** (high, CVSS 7.4, EPSS 0.23%) aaPanel BillionMail: A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The attack may be performed from remote. The… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124579
- **CVE-2026-124577** (critical, CVSS 9.8, EPSS 2.1%) Intelbras SG 2404 PoE L2+: A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124577
- **CVE-2026-124576** (high, CVSS 7.3, EPSS 0.31%) n/a BeikeShop: A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124576
- **CVE-2026-124563** (high, CVSS 7.5, EPSS 0.54%) D-Link DIR-878: A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124563
- **CVE-2026-124560** (critical, CVSS 9.8, EPSS 0.72%) D-Link DIR-878: A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124560
- **CVE-2026-124558** (high, CVSS 7.3, EPSS 0.29%) DataLinkDC Dinky: A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124558
- **CVE-2026-124554** (high, CVSS 7.3, EPSS 0.25%) n/a JeecgBoot: A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124554
- **CVE-2026-124501** (high, CVSS 7.3, EPSS 0.28%) Tidelift moto: A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is possible. The exploit has… Published 2026-11-09. https://nvd.nist.gov/vuln/detail/CVE-2026-124501
- **CVE-2026-118904** (high, CVSS 8.1, EPSS 0.32%) IBM webMethods Integration Server: IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-118904
- **CVE-2026-107331** (critical, CVSS 9.9, EPSS 0.50%) IBM DataStage on Cloud Pak for Data: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-107331
- **CVE-2026-124492** (high, CVSS 7.6, EPSS 0.21%) JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124492
- **CVE-2026-124489** (high, CVSS 7.1, EPSS 0.18%) openemr openemr: OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters to view payment pages and record fraudulent payment receipts… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124489
- **CVE-2026-124488** (high, CVSS 8.1, EPSS 0.22%) openemr openemr: OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124488
- **CVE-2026-124484** (high, CVSS 8.8, EPSS 0.25%) openemr openemr: OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124484
- **CVE-2026-124480** (high, CVSS 8.8, EPSS 0.26%) openemr openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124480
- **CVE-2026-124477** (high, CVSS 8.8, EPSS 0.25%) openemr openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124477
- **CVE-2026-124472** (high, CVSS 8.1, EPSS 0.26%) openemr openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124472
- **CVE-2026-124471** (high, CVSS 8.1, EPSS 0.26%) openemr openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124471
- **CVE-2026-124468** (high, CVSS 7.1, EPSS 0.27%) openemr openemr: OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124468
- **CVE-2026-124467** (high, CVSS 8.8, EPSS 0.46%) openemr openemr: OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<module>/Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extension checks… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124467
- **CVE-2026-124463** (high, CVSS 8.7, EPSS 0.26%) openemr openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124463
- **CVE-2026-124459** (high, CVSS 8.1, EPSS 0.26%) openemr openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124459
- **CVE-2026-124453** (high, CVSS 7.1, EPSS 0.20%) openemr openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting_patient parameter in a JSON POST request to another patient's PID, altering that patient's portal… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124453
- **CVE-2026-124450** (critical, CVSS 9.9, EPSS 0.49%) openemr openemr: OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124450
- **CVE-2026-124446** (high, CVSS 8.8, EPSS 0.35%) openemr openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124446
- **CVE-2026-124445** (critical, CVSS 9.8, EPSS 0.35%) openemr openemr: OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124445
- **CVE-2026-124441** (high, CVSS 8.8, EPSS 0.41%) kyverno kyverno: Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124441
- **CVE-2026-124438** (high, CVSS 7.4, EPSS 0.36%) scriban scriban: Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting… Published 2026-11-08. https://nvd.nist.gov/vuln/detail/CVE-2026-124438

To get a briefing and a fix pull request when one of these is in your own dependencies, see https://zeusqa.ai/features/vulnerability-watch.