Exploited and new serious CVEs: November 2026

FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

• Pre-auth
• Auth bypass

freeswitch · freeswitchNov 5, 2026

A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.

opentext · opentext directory services (otds)Nov 5, 2026

In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows ele

• Local privilege escalation

hewlett packard enterprise (hpe) · hpe cray programming environmentNov 5, 2026

OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

• Pre-auth
• Info leak

open-emr · openemrNov 5, 2026

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

• Pre-auth
• Path traversal

vitali87 · code-graph-ragNov 5, 2026

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

• Pre-auth

python · pillowNov 5, 2026

Black: GitHub Action installs unvalidated required-version from pyproject.toml

psf · blackNov 5, 2026

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

• Pre-auth
• Prototype pollution

ardatan · graphql-toolsNov 5, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

• Pre-auth

wailsapp · wailsNov 5, 2026

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

• Pre-auth

dcmjs-org · dcmjsNov 5, 2026

MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

• Pre-auth

project-monai · monaiNov 5, 2026

OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

• Auth bypass

oauthlib · oauthlibNov 5, 2026

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

• Pre-auth
• Denial of service

bishopfox · sliverNov 5, 2026

Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

• RCE

jhuckaby · cronicleNov 5, 2026

Code Graph RAG structural tools follow out-of-root symlinks

• Path traversal

vitali87 · code-graph-ragNov 5, 2026

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

• Pre-auth
• Auth bypass
• Hard-coded credentials

tpc software · matchpointNov 5, 2026

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

• Pre-auth
• Broken access control (IDOR)

tpc software · matchpointNov 5, 2026

SQL injection in the push notification handler of the MatchPoint Android app

• SQL injection

tpc software · matchpointNov 5, 2026

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint

• Pre-auth
• Auth bypass

tpc software · matchpointNov 5, 2026

Incorrect validation of TLS certificates in the MatchPoint Android app

• Pre-auth
• Weak crypto

tpc software · matchpointNov 5, 2026

Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

• Pre-auth
• Denial of service

modelcontextprotocol · typescript-sdkNov 5, 2026

Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

• Pre-auth
• Race condition

modelcontextprotocol · typescript-sdkNov 5, 2026

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

• Pre-auth
• Info leak

btcpay server · btcpay serverNov 5, 2026

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalat

• Pre-auth
• Weak crypto

chainguard · minioNov 5, 2026

Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

• SQL injection

dolibarr · dolibarrNov 5, 2026

Rucio: Authorisation Bypass on REST API endpoint for signing URLs

• Broken access control (IDOR)

rucio · rucioNov 5, 2026

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

• RCE
• Command injection

ag2ai · ag2Nov 5, 2026

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

• Broken access control (IDOR)

kubeflow · pipelinesNov 5, 2026

Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

• Pre-auth
• SSRF

kubeflow · pipelinesNov 5, 2026

Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints

• Pre-auth
• SSRF

kubeflow · pipelinesNov 5, 2026

Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

• Broken access control (IDOR)

kubeflow · pipelinesNov 5, 2026

FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

• Pre-auth
• Memory safety

pavel-odintsov · fastnetmonNov 5, 2026

FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames

• Pre-auth
• Memory safety

pavel-odintsov · fastnetmonNov 5, 2026

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

• Pre-auth
• Memory safety
• Denial of service

pavel-odintsov · fastnetmonNov 5, 2026

FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

• Pre-auth
• Memory safety

pavel-odintsov · fastnetmonNov 5, 2026

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

• Pre-auth
• Memory safety
• Denial of service

pavel-odintsov · fastnetmonNov 5, 2026

FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo

• Pre-auth
• SQL injection

cern-fts · fts-monitoringNov 6, 2026

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

• Broken access control (IDOR)

subnet solutions · powersystem center 2020Nov 6, 2026

Subnet Solutions PowerSYSTEM Center SQL Injection

• SQL injection

subnet solutions · powersystem center 2024Nov 6, 2026

Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression

• Pre-auth
• Denial of service

dlclark · regexp2Nov 6, 2026

Server-Side Request Forgery in Foxit Workspace File Upload

• SSRF

foxit software inc. · foxit workspaceNov 6, 2026

Foxit Workspace Stored XSS in shared artifacts

• XSS

foxit software inc. · foxit workspaceNov 6, 2026

Server-Side Request Forgery in Foxit Workspace PDF Export

• SSRF

foxit software inc. · foxit workspaceNov 6, 2026

MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

• Pre-auth
• XSS

unknown · mcbNov 6, 2026

Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

• Pre-auth
• SQL injection

unknown · mail mageNov 6, 2026

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

• Pre-auth
• XSS

unknown · advanced custom fields (acf®)Nov 6, 2026

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

• Pre-auth
• Auth bypass

unknown · wurdeyNov 6, 2026

Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update

• Pre-auth

unknown · placesterNov 6, 2026

GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

• Pre-auth
• SQL injection

unknown · gs jwt authentication for wp rest apiNov 6, 2026

WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

• Pre-auth

unknown · whizzNov 6, 2026

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

• Pre-auth
• XSS

unknown · anti-spam, spam firewall by cleantalkNov 6, 2026

Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

• pre-auth RCE

unknown · static snapshotNov 6, 2026

Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import

• Path traversal

unknown · ever accountingNov 6, 2026

All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

• XSS

unknown · all-in-one video galleryNov 6, 2026

iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser

• Pre-auth
• XSS

unknown · iubenda | all-in-one compliance for gdpr / ccpa cookie consent + moreNov 6, 2026

Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission

unknown · cool media filterNov 6, 2026

Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master

• Pre-auth

red hat · red hat openshift ai (rhoai)Nov 6, 2026

WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

• pre-auth RCE
• File upload

unknown · wp libre formNov 6, 2026

WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

shamim rajani · pie registerNov 6, 2026

WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability

• Pre-auth

bakkbone australia · floristpressNov 6, 2026

WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

mamunur rashid · radius booking — booking calendar for appointments &amp; servicesNov 6, 2026

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

• Pre-auth

miniorange · oauth single sign on – sso (oauth client)Nov 6, 2026

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time

• Pre-auth
• Denial of service

Nov 6, 2026

A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-

• Pre-auth

ly corporation · armeriaNov 6, 2026

A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthentic

• Pre-auth

ly corporation · armeriaNov 6, 2026

A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memo

• Pre-auth

ly corporation · armeriaNov 6, 2026

WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

wc lovers · wcfm membershipNov 6, 2026

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR

• Broken access control (IDOR)

unknown · mdjm event managementNov 6, 2026

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

• Pre-auth
• Broken access control (IDOR)

unknown · mdjm event managementNov 6, 2026

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation

• XSS

unknown · mdjm event managementNov 6, 2026

Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings

• Pre-auth
• XSS

iqonicdesign · graphina – charts and graphs for elementor6 days ago

Brute-forceable image-share link password in INFINITT ULite

• Pre-auth

infinitt healthcare · infinitt ulite6 days ago

MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter

• Pre-auth
• XSS

realmag777 · mdtf – meta data and taxonomies filter6 days ago

undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops

• Pre-auth

undici · undici6 days ago

SQL injection in Atmira’s SIREC

• SQL injection

atmira · sirec6 days ago

Dashboard snapshot permission bypass

• Broken access control (IDOR)

grafana · grafana oss6 days ago

Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter

• RCE

wahid0003 · product feed manager for woocommerce – ctx feed – support 220+ shopping, ai & social channels6 days ago

Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

• Pre-auth
• Denial of service

ninenines · cowlib6 days ago

Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

• Pre-auth
• Denial of service

ninenines · cowboy6 days ago

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

jetbrains · clion6 days ago

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

• Broken access control (IDOR)

jetbrains · datalore6 days ago

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

• Pre-auth
• Broken access control (IDOR)

jetbrains · datalore6 days ago

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

jetbrains · datalore6 days ago

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

• Pre-auth

jetbrains · datalore6 days ago

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

• RCE

jetbrains · datalore6 days ago

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

• Pre-auth
• Auth bypass
• Broken access control (IDOR)

jetbrains · datalore6 days ago

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

jetbrains · intellij idea6 days ago

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

jetbrains · hub6 days ago

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

• Broken access control (IDOR)

jetbrains · hub6 days ago

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

• Broken access control (IDOR)

jetbrains · hub6 days ago

In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

• Pre-auth
• XSS

jetbrains · intellij idea6 days ago

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script e

jetbrains · intellij idea6 days ago

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

jetbrains · intellij idea6 days ago

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host

• Pre-auth
• Path traversal

jetbrains · intellij idea6 days ago

In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs

• Pre-auth
• Weak crypto

jetbrains · intellij idea6 days ago

In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option

• RCE

jetbrains · junie cli6 days ago

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

jetbrains · ktor6 days ago

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

jetbrains · webstorm6 days ago

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send

• Broken access control (IDOR)

jetbrains · youtrack6 days ago

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

• Broken access control (IDOR)

jetbrains · youtrack6 days ago