By publication date

Exploited and new serious CVEs: November 2026

3,744 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 10 of 38

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-35494No exploit	In the baseband, memory corruption during NAS packet processing can cause a denial of service.samsung semiconductor · exynos 1280 · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Nov 5, 2026
39Monitor	CVE-2026-48173No exploit	In the NAS message handler, improper validation of the length field in NAS message causes memory corruptionsamsung semiconductor · exynos 850 · CWE-120 Pre-auth Memory safety	Critical9.8	—	0.2%	Nov 5, 2026
39Monitor	CVE-2026-48174No exploit	In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condisamsung semiconductor · exynos 1280 · CWE-476 Pre-auth Memory safety	Critical9.8	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-48176No exploit	A memory corruption vulnerability caused by improper validation of messagessamsung semiconductor · exynos 1080 · CWE-1284 Pre-auth	High7.5	—	0.2%	Nov 5, 2026
35Monitor	CVE-2026-48178No exploit	Out of bound access in PPC due to race condition in global variable accesssamsung semiconductor · exynos 2200 · CWE-413 Race condition	High8.8	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-48179No exploit	In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Servicesamsung semiconductor · exynos 1080 · CWE-1286 Pre-auth Denial of service	High7.5	—	0.2%	Nov 5, 2026
36Monitor	CVE-2026-48183No exploit	Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissionssamsung semiconductor · exynos 1480 · CWE-281 Pre-auth	Critical9.1	—	0.2%	Nov 5, 2026
36Monitor	CVE-2026-48186No exploit	Improper handling of messages before AS security activation can cause unexpected behaviorsamsung semiconductor · exynos 1280 · CWE-754 Pre-auth	Critical9.1	—	0.2%	Nov 5, 2026
32Monitor	CVE-2026-68984No exploit	In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.samsung semiconductor · exynos 2100 · CWE-190 Pre-auth Memory safety	High8.1	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-68985No exploit	In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a samsung semiconductor · exynos 1280 · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Nov 5, 2026
31Monitor	CVE-2026-68990No exploit	In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading samsung semiconductor · exynos 1480 · CWE-681 Local privilege escalation	High7.8	—	0.1%	Nov 5, 2026
39Monitor	CVE-2026-68991No exploit	In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a samsung semiconductor · exynos 1480 · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.2%	Nov 5, 2026
29Monitor	CVE-2026-68994No exploit	A double free vulnerability in NPU driver due to improper pointer management (941)samsung semiconductor · exynos 1480 · CWE-415 Pre-auth Memory safety	High7.3	—	0.1%	Nov 5, 2026
30Monitor	CVE-2026-69002No exploit	Incorrect authorization in Samsung framework services due to missing permission checkssamsung semiconductor · exynos 1580 · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Nov 5, 2026
29Monitor	CVE-2026-69005No exploit	Integer overflow in NPU driver parameter processing due to insufficient bounds checking.samsung semiconductor · exynos 1480 · CWE-190 Pre-auth Memory safety	High7.3	—	0.1%	Nov 5, 2026
36Monitor	CVE-2026-69006No exploit	Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.samsung semiconductor · exynos 850 · CWE-754 Pre-auth	Critical9.1	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-69025No exploit	In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial osamsung semiconductor · exynos 1480 · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Nov 5, 2026
36Monitor	CVE-2026-69043No exploit	In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruptionsamsung semiconductor · exynos 2200 · CWE-416 Pre-auth Memory safety	Critical9.1	—	0.2%	Nov 5, 2026
33Monitor	CVE-2026-69044No exploit	In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.samsung semiconductor · exynos 1580 · CWE-416 Memory safety	High8.4	—	0.1%	Nov 5, 2026
39Monitor	CVE-2026-69050No exploit	Out-of-bounds memory access in a device driver due to improper resource state tracking.samsung semiconductor · exynos 1480 · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.2%	Nov 5, 2026
33Monitor	CVE-2026-69066No exploit	Memory corruption in GPU driver due to improper validation of VMID reservation.samsung semiconductor · exynos 2200 · CWE-754	High8.4	—	0.1%	Nov 5, 2026
36Monitor	CVE-2026-69068No exploit	Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.samsung semiconductor · exynos modem 5300 · CWE-787 Pre-auth Memory safety	Critical9.1	—	0.2%	Nov 5, 2026
32Monitor	CVE-2026-116617No exploit	Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameterstylemix · motors – car dealership & classified listings plugin · CWE-22 Path traversal	High8.1	—	0.4%	Nov 5, 2026
35Monitor	CVE-2026-118193No exploit	GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameterstellarwp · givewp – donation plugin and fundraising platform · CWE-269	High8.8	—	0.3%	Nov 5, 2026
28Monitor	CVE-2026-123010No exploit	@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.twilio-labs · netlify-okta-auth · CWE-669 Pre-auth	High7.2	—	0.2%	Nov 5, 2026
28Monitor	CVE-2026-123012No exploit	In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a digogs · gogs · CWE-178	High7.1	—	0.3%	Nov 5, 2026
32Monitor	CVE-2026-93389No exploit	LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Cachinglitespeedtech · litespeed cache · CWE-200 Pre-auth Info leak	High8.2	—	0.2%	Nov 5, 2026
35Monitor	CVE-2025-15702No exploit	Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSSunknown · cloud blocks · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Nov 5, 2026
37Monitor	CVE-2026-100144No exploit	IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameterunknown · ivpay payments · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Nov 5, 2026
28Monitor	CVE-2026-109150No exploit	WP PageNavi Style <= 1.4 - Stored XSS via CSRFunknown · wp pagenavi style · CWE-79 Pre-auth XSS CSRF	High7.1	—	0.0%	Nov 5, 2026
34Monitor	CVE-2026-123014Proof of concept	iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary citerm2 · iterm2 · CWE-88 pre-auth RCE	High8.7	—	0.4%	Nov 5, 2026
32Monitor	CVE-2026-16304No exploit	WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_idsunknown · wp event manager · CWE-639 Broken access control (IDOR)	High8.1	—	0.2%	Nov 5, 2026
39Monitor	CVE-2026-19256No exploit	All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Forceunknown · all in one login · CWE-269 Pre-auth	Critical9.8	—	0.2%	Nov 5, 2026
32Monitor	CVE-2026-86442No exploit	WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDORunknown · wp event manager · CWE-639 Pre-auth Broken access control (IDOR)	High8.2	—	0.1%	Nov 5, 2026
37Monitor	CVE-2026-123025Proof of concept	An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin throughopnsense · os-acme-client · CWE-78 RCE Command injection	Critical9.4	—	0.6%	Nov 5, 2026
30Monitor	CVE-2026-123029No exploit	Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges wowza · streaming engine · CWE-611 Pre-auth XXE	High7.5	—	0.3%	Nov 5, 2026
33Monitor	CVE-2026-123033No exploit	Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their reixsystems · truenas scale · CWE-290 Pre-auth Auth bypass	High8.3	—	0.4%	Nov 5, 2026
39Monitor	CVE-2026-100109Proof of concept	Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userunknown · security for woocommerce · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Nov 5, 2026
29Monitor	CVE-2026-109408No exploit	vault-java-driver: SslConfig silently disables requested TLS verificationjopenlibs · vault-java-driver · CWE-295 Pre-auth Deserialization Weak crypto	High7.4	—	0.1%	Nov 5, 2026
34Monitor	CVE-2026-118869No exploit	An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on theshirasagi project · shirasagi · CWE-78 RCE Command injection	High8.7	—	1.0%	Nov 5, 2026
40Plan	CVE-2026-121489No exploit	Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryapache software foundation · apache juneau · CWE-22 Pre-auth Path traversal	Critical10.0	—	0.4%	Nov 5, 2026
34Monitor	CVE-2026-73095No exploit	Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingapache software foundation · apache juneau · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Nov 5, 2026
40Plan	CVE-2026-73098No exploit	Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingapache software foundation · apache juneau · CWE-470 Pre-auth	Critical10.0	—	0.4%	Nov 5, 2026
40Plan	CVE-2026-73099No exploit	Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body overrideapache software foundation · apache juneau · CWE-352 Pre-auth CSRF	Critical10.0	—	0.2%	Nov 5, 2026
40Plan	CVE-2026-73100No exploit	Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsapache software foundation · apache juneau · CWE-532 Pre-auth Info leak	Critical10.0	—	0.4%	Nov 5, 2026
40Plan	CVE-2026-73101No exploit	Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsapache software foundation · apache juneau · CWE-209 Pre-auth Info leak	Critical10.0	—	0.4%	Nov 5, 2026
40Plan	CVE-2026-73116No exploit	Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsapache software foundation · apache juneau · CWE-522 Pre-auth Info leak	Critical10.0	—	0.4%	Nov 5, 2026
40Plan	CVE-2026-73117No exploit	Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataapache software foundation · apache juneau · CWE-113 Pre-auth Open redirect	Critical10.0	—	0.4%	Nov 5, 2026
40Plan	CVE-2026-96677No exploit	Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeapache software foundation · apache juneau · CWE-79 Pre-auth XSS	Critical10.0	—	0.4%	Nov 5, 2026
30Monitor	CVE-2026-103864No exploit	Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralizationapache software foundation · apache sling engine · CWE-117 Pre-auth	High7.5	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-103866No exploit	Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglingapache software foundation · apache sling engine · CWE-436 Pre-auth	High7.5	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-123047No exploit	Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Chartseclipse foundation · eclipse basyx helm charts · CWE-312	High7.5	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-104720No exploit	Path Traversal in Kobikom Telecommunications' Kobikomkobikom telecommunications and informatics services inc. · kobikom · CWE-22 Pre-auth Path traversal	High7.5	—	0.4%	Nov 5, 2026
30Monitor	CVE-2026-105321No exploit	SQL Injection in Kobikom Telecommunications' Kobikomkobikom telecommunications and informatics services inc. · kobikom · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-105325No exploit	Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationsapache software foundation · apache ofbiz · CWE-425 Pre-auth	High7.5	—	0.2%	Nov 5, 2026
39Monitor	CVE-2026-105330No exploit	Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Accessapache software foundation · apache ofbiz · CWE-321 Pre-auth Hard-coded credentials	Critical9.8	—	0.6%	Nov 5, 2026
30Monitor	CVE-2026-105461No exploit	Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitiesapache software foundation · apache ofbiz · CWE-425 Pre-auth	High7.5	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-107912No exploit	Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawred hat · exploit intelligence · CWE-862 Broken access control (IDOR)	High7.7	—	0.1%	Nov 5, 2026
29Monitor	CVE-2026-109928No exploit	Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeoverapache · ofbiz · CWE-303 Pre-auth	High7.4	—	0.3%	Nov 5, 2026
32Monitor	CVE-2026-114233No exploit	Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Ordersapache · ofbiz · CWE-266	High8.1	—	0.4%	Nov 5, 2026
36Monitor	CVE-2026-117691Proof of concept	Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesred hat · red hat build of keycloak · CWE-347 Pre-auth Weak crypto	Critical9.1	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-123059No exploit	Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Chartseclipse foundation · eclipse basyx helm charts · CWE-312	High7.5	—	0.2%	Nov 5, 2026
30Monitor	CVE-2026-82904No exploit	Apache OFBiz: Unbounded multi-form row count from a parameter nameapache · ofbiz · CWE-770 Pre-auth CSRF Denial of service	High7.5	—	0.6%	Nov 5, 2026
39Monitor	CVE-2026-82907No exploit	Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundapache · ofbiz · CWE-294 Pre-auth Auth bypass CSRF	Critical9.8	—	0.8%	Nov 5, 2026
35Monitor	CVE-2026-82910No exploit	Apache OFBiz: renderLink compiles link parameters as FreeMarker sourceapache · ofbiz · CWE-1336 RCE SSTI	High8.8	—	0.8%	Nov 5, 2026
35Monitor	CVE-2026-82912No exploit	Apache OFBiz: Unsandboxed Groovy compiled from a service parameterapache · ofbiz · CWE-917 RCE	High8.8	—	0.8%	Nov 5, 2026
28Monitor	CVE-2026-82916No exploit	Apache OFBiz: webtools xmldsdump exports any entity to any pathapache · ofbiz · CWE-73 Path traversal	High7.1	—	0.6%	Nov 5, 2026
35Monitor	CVE-2026-82960No exploit	Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEapache · ofbiz · CWE-94 RCE	High8.8	—	0.7%	Nov 5, 2026
39Monitor	CVE-2026-83542Proof of concept	Apache OFBiz: Unauthenticated RCE via login-page widget injectionapache · ofbiz · CWE-94 pre-auth RCE	Critical9.8	—	1.2%	Nov 5, 2026
35Monitor	CVE-2026-84183No exploit	Apache OFBiz: Content Manager VIEW-only RCE in updateLayoutapache · ofbiz · CWE-863 RCE Broken access control (IDOR)	High8.8	—	1.1%	Nov 5, 2026
35Monitor	CVE-2026-85627No exploit	Apache OFBiz: Authenticated Code Execution Vulnerabilityapache · ofbiz · CWE-425 RCE SSTI	High8.8	—	0.5%	Nov 5, 2026
29Monitor	CVE-2026-92887No exploit	Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationapache · ofbiz · CWE-306 Pre-auth Auth bypass	High7.3	—	0.6%	Nov 5, 2026
30Monitor	CVE-2026-106713No exploit	An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Nov 5, 2026
32Monitor	CVE-2026-106714No exploit	Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebViewCWE-601 Pre-auth Open redirect	High8.1	—	0.2%	Nov 5, 2026
28Monitor	CVE-2026-115738No exploit	SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queritrellix · dlp on-prem extensions · CWE-89 SQL injection	High7.1	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-119744No exploit	Cendio ThinLinc Improper Authentication via Web Accesscendio · thinlinc · CWE-290 Auth bypass	High7.7	—	0.4%	Nov 5, 2026
30Monitor	CVE-2026-68524Proof of concept	Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loadingapache software foundation · apache ofbiz · CWE-94 pre-auth RCE	High7.5	—	0.3%	Nov 5, 2026
32Monitor	CVE-2026-71901No exploit	Apache OFBiz: Dispatch arbitrary internal services on SFA componentapache software foundation · apache ofbiz · CWE-99	High8.1	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-73577Proof of concept	Apache OFBiz: Unauthenticated path-suffix view authorization bypassapache software foundation · apache ofbiz · CWE-288 Pre-auth Auth bypass	High7.5	—	0.5%	Nov 5, 2026
30Monitor	CVE-2026-73578No exploit	Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impactapache software foundation · apache ofbiz · CWE-288 pre-auth RCE Auth bypass	High7.5	—	0.6%	Nov 5, 2026
36Monitor	CVE-2026-74841No exploit	Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modeapache software foundation · apache ofbiz · CWE-400 Pre-auth Denial of service	Critical9.1	—	0.5%	Nov 5, 2026
39Monitor	CVE-2026-81815No exploit	Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBapache software foundation · apache ofbiz · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Nov 5, 2026
32Monitor	CVE-2026-81828No exploit	Apache OFBiz: Server-side request forgery in SurveyWrapperapache software foundation · apache ofbiz · CWE-918 SSRF	High8.1	—	0.3%	Nov 5, 2026
30Monitor	CVE-2026-82894No exploit	Apache OFBiz: Content renderer runs a service name stored on the rowapache software foundation · apache ofbiz · CWE-470 Pre-auth SSRF	High7.5	—	0.5%	Nov 5, 2026
31Monitor	CVE-2019-16447No exploit	Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability.adobe · adobe illustrator cc · CWE-427	High7.8	—	0.3%	Nov 5, 2026
35Monitor	CVE-2020-9709No exploit	Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability.adobe · adobe photoshop · CWE-269 Pre-auth	High8.8	—	1.1%	Nov 5, 2026
32Monitor	CVE-2026-102523No exploit	MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITIONmariadb · server · CWE-73 Path traversal	High8.0	—	0.7%	Nov 5, 2026
30Monitor	CVE-2026-102615No exploit	HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSSheyform · heyform · CWE-79 XSS	High7.6	—	0.2%	Nov 5, 2026
34Monitor	CVE-2026-104269No exploit	ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)owasp-modsecurity · modsecurity · CWE-436 Pre-auth	High8.6	—	0.5%	Nov 5, 2026
32Monitor	CVE-2026-107891No exploit	musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incormusl -libc · musl · CWE-190 Pre-auth Memory safety	High8.1	—	0.5%	Nov 5, 2026
36Monitor	CVE-2026-119344No exploit	Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacksultravioletrs · cocos · CWE-346 Pre-auth	Critical9.1	—	0.3%	Nov 5, 2026
28Monitor	CVE-2026-119345No exploit	Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacksultravioletrs · cocos · CWE-367 Race condition	High7.2	—	0.1%	Nov 5, 2026
29Monitor	CVE-2026-121139No exploit	Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authenticationrapid7 · metasploit framework · CWE-306 Auth bypass	High7.3	—	0.1%	Nov 5, 2026
34Monitor	CVE-2026-122328No exploit	SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoderlibsdl-org · sdl_mixer · CWE-121 Memory safety	High8.5	—	0.1%	Nov 5, 2026
34Monitor	CVE-2026-122329No exploit	SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoderlibsdl-org · sdl_mixer · CWE-121 Memory safety	High8.5	—	0.1%	Nov 5, 2026
30Monitor	CVE-2026-123095No exploit	mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlinesmpv-player · mpv · CWE-93 Pre-auth	High7.7	—	0.4%	Nov 5, 2026
28Monitor	CVE-2026-123096No exploit	anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Responseanacrolix · torrent · CWE-770 Pre-auth Denial of service	High7.1	—	0.2%	Nov 5, 2026
68This week	CVE-2026-123158Weaponized	sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (relatedopenbsd · openssh · CWE-394 Pre-auth Auth bypass	High8.1	KEV	18.9%	Nov 5, 2026
31Monitor	CVE-2026-70659No exploit	stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor nameleejet · stable-diffusion.cpp · CWE-787 Memory safety	High7.8	—	0.1%	Nov 5, 2026
34Monitor	CVE-2026-73856No exploit	ModSecurity: Response Body Inspection Bypassowasp-modsecurity · modsecurity · CWE-178 Pre-auth	High8.6	—	0.5%	Nov 5, 2026

CVE-2026-35494
30Monitor
In the baseband, memory corruption during NAS packet processing can cause a denial of service.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
samsung semiconductor · exynos 1280Nov 5, 2026
CVE-2026-48173
39Monitor
In the NAS message handler, improper validation of the length field in NAS message causes memory corruption
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 850Nov 5, 2026
CVE-2026-48174
39Monitor
In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condi
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 1280Nov 5, 2026
CVE-2026-48176
30Monitor
A memory corruption vulnerability caused by improper validation of messages
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
samsung semiconductor · exynos 1080Nov 5, 2026
CVE-2026-48178
35Monitor
Out of bound access in PPC due to race condition in global variable access
HighCVSS 8.8No exploitEPSS 0%
- Race condition
samsung semiconductor · exynos 2200Nov 5, 2026
CVE-2026-48179
30Monitor
In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
samsung semiconductor · exynos 1080Nov 5, 2026
CVE-2026-48183
36Monitor
Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-48186
36Monitor
Improper handling of messages before AS security activation can cause unexpected behavior
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
samsung semiconductor · exynos 1280Nov 5, 2026
CVE-2026-68984
32Monitor
In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 2100Nov 5, 2026
CVE-2026-68985
30Monitor
In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
samsung semiconductor · exynos 1280Nov 5, 2026
CVE-2026-68990
31Monitor
In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-68991
39Monitor
In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-68994
29Monitor
A double free vulnerability in NPU driver due to improper pointer management (941)
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-69002
30Monitor
Incorrect authorization in Samsung framework services due to missing permission checks
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
samsung semiconductor · exynos 1580Nov 5, 2026
CVE-2026-69005
29Monitor
Integer overflow in NPU driver parameter processing due to insufficient bounds checking.
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-69006
36Monitor
Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
samsung semiconductor · exynos 850Nov 5, 2026
CVE-2026-69025
30Monitor
In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial o
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-69043
36Monitor
In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 2200Nov 5, 2026
CVE-2026-69044
33Monitor
In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
samsung semiconductor · exynos 1580Nov 5, 2026
CVE-2026-69050
39Monitor
Out-of-bounds memory access in a device driver due to improper resource state tracking.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos 1480Nov 5, 2026
CVE-2026-69066
33Monitor
Memory corruption in GPU driver due to improper validation of VMID reservation.
HighCVSS 8.4No exploitEPSS 0%
samsung semiconductor · exynos 2200Nov 5, 2026
CVE-2026-69068
36Monitor
Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
samsung semiconductor · exynos modem 5300Nov 5, 2026
CVE-2026-116617
32Monitor
Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
stylemix · motors – car dealership & classified listings pluginNov 5, 2026
CVE-2026-118193
35Monitor
GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
HighCVSS 8.8No exploitEPSS 0%
stellarwp · givewp – donation plugin and fundraising platformNov 5, 2026
CVE-2026-123010
28Monitor
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
twilio-labs · netlify-okta-authNov 5, 2026
CVE-2026-123012
28Monitor
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a di
HighCVSS 7.1No exploitEPSS 0%
gogs · gogsNov 5, 2026
CVE-2026-93389
32Monitor
LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
litespeedtech · litespeed cacheNov 5, 2026
CVE-2025-15702
35Monitor
Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · cloud blocksNov 5, 2026
CVE-2026-100144
37Monitor
IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · ivpay paymentsNov 5, 2026
CVE-2026-109150
28Monitor
WP PageNavi Style <= 1.4 - Stored XSS via CSRF
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
unknown · wp pagenavi styleNov 5, 2026
CVE-2026-123014
34Monitor
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary c
HighCVSS 8.7Proof of conceptEPSS 0%
- pre-auth RCE
iterm2 · iterm2Nov 5, 2026
CVE-2026-16304
32Monitor
WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
unknown · wp event managerNov 5, 2026
CVE-2026-19256
39Monitor
All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · all in one loginNov 5, 2026
CVE-2026-86442
32Monitor
WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · wp event managerNov 5, 2026
CVE-2026-123025
37Monitor
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through
CriticalCVSS 9.4Proof of conceptEPSS 0%
- RCE
- Command injection
opnsense · os-acme-clientNov 5, 2026
CVE-2026-123029
30Monitor
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XXE
wowza · streaming engineNov 5, 2026
CVE-2026-123033
33Monitor
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their re
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
ixsystems · truenas scaleNov 5, 2026
CVE-2026-100109
39Monitor
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · security for woocommerceNov 5, 2026
CVE-2026-109408
29Monitor
vault-java-driver: SslConfig silently disables requested TLS verification
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Deserialization
- Weak crypto
jopenlibs · vault-java-driverNov 5, 2026
CVE-2026-118869
34Monitor
An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Command injection
shirasagi project · shirasagiNov 5, 2026
CVE-2026-121489
40Plan
Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Path traversal
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73095
34Monitor
Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73098
40Plan
Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73099
40Plan
Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- CSRF
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73100
40Plan
Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73101
40Plan
Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73116
40Plan
Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache juneauNov 5, 2026
CVE-2026-73117
40Plan
Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Open redirect
apache software foundation · apache juneauNov 5, 2026
CVE-2026-96677
40Plan
Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- XSS
apache software foundation · apache juneauNov 5, 2026
CVE-2026-103864
30Monitor
Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache sling engineNov 5, 2026
CVE-2026-103866
30Monitor
Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache sling engineNov 5, 2026
CVE-2026-123047
30Monitor
Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
HighCVSS 7.5No exploitEPSS 0%
eclipse foundation · eclipse basyx helm chartsNov 5, 2026
CVE-2026-104720
30Monitor
Path Traversal in Kobikom Telecommunications' Kobikom
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
kobikom telecommunications and informatics services inc. · kobikomNov 5, 2026
CVE-2026-105321
30Monitor
SQL Injection in Kobikom Telecommunications' Kobikom
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
kobikom telecommunications and informatics services inc. · kobikomNov 5, 2026
CVE-2026-105325
30Monitor
Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-105330
39Monitor
Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-105461
30Monitor
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-107912
30Monitor
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
red hat · exploit intelligenceNov 5, 2026
CVE-2026-109928
29Monitor
Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
apache · ofbizNov 5, 2026
CVE-2026-114233
32Monitor
Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
HighCVSS 8.1No exploitEPSS 0%
apache · ofbizNov 5, 2026
CVE-2026-117691
36Monitor
Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
red hat · red hat build of keycloakNov 5, 2026
CVE-2026-123059
30Monitor
Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
HighCVSS 7.5No exploitEPSS 0%
eclipse foundation · eclipse basyx helm chartsNov 5, 2026
CVE-2026-82904
30Monitor
Apache OFBiz: Unbounded multi-form row count from a parameter name
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
- Denial of service
apache · ofbizNov 5, 2026
CVE-2026-82907
39Monitor
Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
apache · ofbizNov 5, 2026
CVE-2026-82910
35Monitor
Apache OFBiz: renderLink compiles link parameters as FreeMarker source
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SSTI
apache · ofbizNov 5, 2026
CVE-2026-82912
35Monitor
Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
HighCVSS 8.8No exploitEPSS 0%
- RCE
apache · ofbizNov 5, 2026
CVE-2026-82916
28Monitor
Apache OFBiz: webtools xmldsdump exports any entity to any path
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
apache · ofbizNov 5, 2026
CVE-2026-82960
35Monitor
Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
HighCVSS 8.8No exploitEPSS 0%
- RCE
apache · ofbizNov 5, 2026
CVE-2026-83542
39Monitor
Apache OFBiz: Unauthenticated RCE via login-page widget injection
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
apache · ofbizNov 5, 2026
CVE-2026-84183
35Monitor
Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Broken access control (IDOR)
apache · ofbizNov 5, 2026
CVE-2026-85627
35Monitor
Apache OFBiz: Authenticated Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SSTI
apache · ofbizNov 5, 2026
CVE-2026-92887
29Monitor
Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache · ofbizNov 5, 2026
CVE-2026-106713
30Monitor
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
Nov 5, 2026
CVE-2026-106714
32Monitor
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Open redirect
Nov 5, 2026
CVE-2026-115738
28Monitor
SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queri
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
trellix · dlp on-prem extensionsNov 5, 2026
CVE-2026-119744
30Monitor
Cendio ThinLinc Improper Authentication via Web Access
HighCVSS 7.7No exploitEPSS 0%
- Auth bypass
cendio · thinlincNov 5, 2026
CVE-2026-68524
30Monitor
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
HighCVSS 7.5Proof of conceptEPSS 0%
- pre-auth RCE
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-71901
32Monitor
Apache OFBiz: Dispatch arbitrary internal services on SFA component
HighCVSS 8.1No exploitEPSS 0%
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-73577
30Monitor
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-73578
30Monitor
Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-74841
36Monitor
Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-81815
39Monitor
Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-81828
32Monitor
Apache OFBiz: Server-side request forgery in SurveyWrapper
HighCVSS 8.1No exploitEPSS 0%
- SSRF
apache software foundation · apache ofbizNov 5, 2026
CVE-2026-82894
30Monitor
Apache OFBiz: Content renderer runs a service name stored on the row
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
apache software foundation · apache ofbizNov 5, 2026
CVE-2019-16447
31Monitor
Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability.
HighCVSS 7.8No exploitEPSS 0%
adobe · adobe illustrator ccNov 5, 2026
CVE-2020-9709
35Monitor
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability.
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
adobe · adobe photoshopNov 5, 2026
CVE-2026-102523
32Monitor
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
HighCVSS 8.0No exploitEPSS 0%
- Path traversal
mariadb · serverNov 5, 2026
CVE-2026-102615
30Monitor
HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
HighCVSS 7.6No exploitEPSS 0%
- XSS
heyform · heyformNov 5, 2026
CVE-2026-104269
34Monitor
ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
owasp-modsecurity · modsecurityNov 5, 2026
CVE-2026-107891
32Monitor
musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incor
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
musl -libc · muslNov 5, 2026
CVE-2026-119344
36Monitor
Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
ultravioletrs · cocosNov 5, 2026
CVE-2026-119345
28Monitor
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
HighCVSS 7.2No exploitEPSS 0%
- Race condition
ultravioletrs · cocosNov 5, 2026
CVE-2026-121139
29Monitor
Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication
HighCVSS 7.3No exploitEPSS 0%
- Auth bypass
rapid7 · metasploit frameworkNov 5, 2026
CVE-2026-122328
34Monitor
SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
libsdl-org · sdl_mixerNov 5, 2026
CVE-2026-122329
34Monitor
SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
libsdl-org · sdl_mixerNov 5, 2026
CVE-2026-123095
30Monitor
mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
mpv-player · mpvNov 5, 2026
CVE-2026-123096
28Monitor
anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
anacrolix · torrentNov 5, 2026
CVE-2026-123158
68This week
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related
HighCVSS 8.1KEVWeaponizedEPSS 18%
- Pre-auth
- Auth bypass
openbsd · opensshNov 5, 2026
CVE-2026-70659
31Monitor
stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
leejet · stable-diffusion.cppNov 5, 2026
CVE-2026-73856
34Monitor
ModSecurity: Response Body Inspection Bypass
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
owasp-modsecurity · modsecurityNov 5, 2026