Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: November 2026

3,744 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 13 of 38

  • CVE-2026-123325
    28Monitor

    In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sand

    HighCVSS 7.1No exploitEPSS 0%

    jetbrains · youtrack6 days ago

  • CVE-2026-123326
    28Monitor

    In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

    HighCVSS 7.1No exploitEPSS 0%

    jetbrains · youtrack6 days ago

  • CVE-2026-123327
    30Monitor

    In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions

    HighCVSS 7.5No exploitEPSS 0%

    jetbrains · youtrack6 days ago

  • CVE-2026-103479
    30Monitor

    Pubjet | پاب‌جت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action

    HighCVSS 7.6No exploitEPSS 0%

    pubjet · pubjet | پاب‌جت6 days ago

  • CVE-2026-104010
    30Monitor

    WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserializ

    HighCVSS 7.5No exploitEPSS 0%

    creativewerkdesigns · wpsyncsheets for contact form 7 – cf7 google sheets connector & save to database6 days ago

  • CVE-2026-107622
    39Monitor

    BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

    CriticalCVSS 9.8No exploitEPSS 0%

    themekraft · buddyforms6 days ago

  • CVE-2026-114630
    36Monitor

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    elextensions · elex wordpress helpdesk & customer ticketing system6 days ago

  • CVE-2026-116624
    35Monitor

    Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

    HighCVSS 8.8No exploitEPSS 0%

    danbilabs · advanced members for acf6 days ago

  • CVE-2026-123655
    30Monitor

    Moodle: missing access checks on h5p content files

    HighCVSS 7.5No exploitEPSS 0%

    6 days ago

  • CVE-2026-49939
    30Monitor

    Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol

    HighCVSS 7.5No exploitEPSS 0%

    apache software foundation · apache james6 days ago

  • CVE-2026-74756
    36Monitor

    Apache James: WebAdmin exposed without authentication on official Docker default

    CriticalCVSS 9.1No exploitEPSS 0%

    apache software foundation · apache james6 days ago

  • CVE-2026-76168
    39Monitor

    Apache James: ManageSieve file implementation cross-user path traversal

    CriticalCVSS 9.8No exploitEPSS 0%

    apache software foundation · apache james6 days ago

  • CVE-2026-76171
    36Monitor

    Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

    CriticalCVSS 9.1No exploitEPSS 0%

    apache software foundation · apache james6 days ago

  • CVE-2026-85108
    30Monitor

    Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

    HighCVSS 7.5No exploitEPSS 0%

    apache software foundation · apache james mime4j core6 days ago

  • CVE-2026-85111
    34Monitor

    Apache James: Denial of service upon MIME parsing

    HighCVSS 8.7No exploitEPSS 0%

    apache software foundation · apache james6 days ago

  • CVE-2026-92895
    32Monitor

    Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

    HighCVSS 8.1No exploitEPSS 0%

    jiangweifang · live2dwebcanvas6 days ago

  • CVE-2026-109883
    28Monitor

    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    elementor · elementor website builder6 days ago

  • CVE-2026-109884
    28Monitor

    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    elementor · elementor website builder6 days ago

  • CVE-2026-115431
    28Monitor

    WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wp swings · upsell order bump offer for woocommerce6 days ago

  • CVE-2026-92080
    17Monitor

    Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair

    MediumCVSS 4.3Proof of conceptEPSS 0%

    tübi̇tak bi̇lgem software technologies research institute · pardus-boot-repair6 days ago

  • CVE-2026-106019
    35Monitor

    Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System

    HighCVSS 8.8No exploitEPSS 0%

    johnson controls · c-cure 9000, victor6 days ago

  • CVE-2026-106020
    34Monitor

    Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows S

    HighCVSS 8.6No exploitEPSS 0%

    johnson controls · easyio neo io manager and tools installer6 days ago

  • CVE-2026-106022
    34Monitor

    Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retri

    HighCVSS 8.6No exploitEPSS 0%

    johnson controls · easyio neo iomanager and tools installer6 days ago

  • CVE-2026-112336
    28Monitor

    Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder

    HighCVSS 7.1No exploitEPSS 0%

    wazuh · wazuh6 days ago

  • CVE-2026-112338
    32Monitor

    Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination

    HighCVSS 8.2No exploitEPSS 0%

    wazuh · wazuh6 days ago

  • CVE-2026-112339
    32Monitor

    Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

    HighCVSS 8.2No exploitEPSS 0%

    wazuh · wazuh6 days ago

  • CVE-2026-112340
    35Monitor

    Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request

    HighCVSS 8.8No exploitEPSS 0%

    wazuh · wazuh-dashboard-plugins6 days ago

  • CVE-2026-112341
    28Monitor

    Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params

    HighCVSS 7.1No exploitEPSS 0%

    wazuh · wazuh6 days ago

  • CVE-2026-119170
    32Monitor

    Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

    HighCVSS 8.2No exploitEPSS 0%

    python software foundation · cpython6 days ago

  • CVE-2026-123485
    28Monitor

    Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources

    HighCVSS 7.1No exploitEPSS 0%

    sgoudelis · ground-station6 days ago

  • CVE-2026-123487
    34Monitor

    Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex

    HighCVSS 8.7No exploitEPSS 0%

    parse-community · parse-server6 days ago

  • CVE-2026-123488
    37Monitor

    Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    craftcms · cms6 days ago

  • CVE-2026-123489
    28Monitor

    Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

    HighCVSS 7.1No exploitEPSS 0%

    craftcms · cms6 days ago

  • CVE-2026-123490
    34Monitor

    Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

    HighCVSS 8.7No exploitEPSS 0%

    craftcms · cms6 days ago

  • CVE-2026-123491
    35Monitor

    Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

    HighCVSS 8.8No exploitEPSS 0%

    craftcms · cms6 days ago

  • CVE-2026-123618
    30Monitor

    ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

    HighCVSS 7.6Proof of conceptEPSS 0%

    abpframework · abp6 days ago

  • CVE-2026-123620
    30Monitor

    Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion

    HighCVSS 7.7No exploitEPSS 1%

    webmin · usermin6 days ago

  • CVE-2026-123621
    34Monitor

    Usermin through 2.570 Path Traversal File Write via detachall.cgi

    HighCVSS 8.6No exploitEPSS 0%

    webmin · usermin6 days ago

  • CVE-2026-123783
    34Monitor

    Skyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode

    HighCVSS 8.7No exploitEPSS 0%

    skyvern-ai · skyvern6 days ago

  • CVE-2026-123784
    34Monitor

    Fluxbox through 1.3.7 OS Command Injection via Style Background Values

    HighCVSS 8.5No exploitEPSS 0%

    fluxbox · fluxbox6 days ago

  • CVE-2026-123786
    33Monitor

    Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token

    HighCVSS 8.4No exploitEPSS 0%

    agenta-ai · agenta6 days ago

  • CVE-2026-53980
    34Monitor

    Charmbracelet Wish 2.0.5 Path Traversal via git Middleware

    HighCVSS 8.6No exploitEPSS 0%

    charmbracelet · wish6 days ago

  • CVE-2026-59105
    37Monitor

    Universal sysadmin credential vulnerability in Jumis

    CriticalCVSS 9.3No exploitEPSS 1%

    jumis pro sia · jumis6 days ago

  • CVE-2026-64894
    29Monitor

    Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows M

    HighCVSS 7.3No exploitEPSS 0%

    johnson controls · easyio neo iomanager and tools installer6 days ago

  • CVE-2026-87045
    30Monitor

    NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

    HighCVSS 7.5No exploitEPSS 0%

    zephyrproject · zephyr6 days ago

  • CVE-2026-121623
    32Monitor

    Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

    HighCVSS 8.2No exploitEPSS 0%

    sensiolabs · symfony6 days ago

  • CVE-2026-123623
    32Monitor

    Grida through 0.0.24 Missing Authorization in Forms File-Preview API

    HighCVSS 8.2No exploitEPSS 0%

    gridaco · grida6 days ago

  • CVE-2026-123792
    34Monitor

    Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

    HighCVSS 8.7No exploitEPSS 0%

    sensiolabs · symfony6 days ago

  • CVE-2026-58141
    28Monitor

    Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints

    HighCVSS 7.2No exploitEPSS 0%

    langgenius · dify6 days ago

  • CVE-2026-80301
    35Monitor

    Avast sandbox escape via unpreserved COM pathway through Task Scheduler

    HighCVSS 8.8No exploitEPSS 0%

    gen digital · avast antivirus, avast one, avast premium security, avast ultimate6 days ago

  • CVE-2026-80302
    35Monitor

    Avast sandbox escape via arbitrary file write in virtualized environment

    HighCVSS 8.8No exploitEPSS 0%

    gen digital · avast antivirus, avast one, avast premium security, avast ultimate6 days ago

  • CVE-2026-90436
    39Monitor

    Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    apache software foundation · apache axis 1.x (eol)6 days ago

  • CVE-2026-103985
    28Monitor

    FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save

    HighCVSS 7.1No exploitEPSS 0%

    freescout-help-desk · freescout6 days ago

  • CVE-2026-104656
    29Monitor

    Cross-site Scripting in Progress Telerik Fiddler Everywhere

    HighCVSS 7.3No exploitEPSS 0%

    progress software · progress® telerik® fiddler® everywhere6 days ago

  • CVE-2026-104657
    30Monitor

    Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill

    HighCVSS 7.5No exploitEPSS 0%

    progress software · fiddler download & setup skill6 days ago

  • CVE-2026-118515
    33Monitor

    Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

    HighCVSS 8.4No exploitEPSS 0%

    sensiolabs · symfony6 days ago

  • CVE-2026-122193
    37Monitor

    OS command injection in the example SSM documents in Trusted Remote Execution (REX)

    CriticalCVSS 9.3No exploitEPSS 1%

    aws · trusted-remote-execution6 days ago

  • CVE-2026-123831
    38Monitor

    In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

    CriticalCVSS 9.6No exploitEPSS 0%

    jetbrains · clion6 days ago

  • CVE-2026-123832
    38Monitor

    In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

    CriticalCVSS 9.6No exploitEPSS 0%

    jetbrains · clion6 days ago

  • CVE-2026-123834
    32Monitor

    In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

    HighCVSS 8.1No exploitEPSS 0%

    jetbrains · datalore6 days ago

  • CVE-2026-123836
    35Monitor

    In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

    HighCVSS 8.8No exploitEPSS 0%

    jetbrains · datalore6 days ago

  • CVE-2026-123837
    31Monitor

    In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WS

    HighCVSS 7.8No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123838
    31Monitor

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

    HighCVSS 7.8No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123841
    31Monitor

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

    HighCVSS 7.8No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123842
    28Monitor

    In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives

    HighCVSS 7.1No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123848
    29Monitor

    In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

    HighCVSS 7.4No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123849
    28Monitor

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

    HighCVSS 7.0No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123852
    29Monitor

    In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

    HighCVSS 7.4No exploitEPSS 0%

    jetbrains · junie github action6 days ago

  • CVE-2026-123853
    31Monitor

    In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build

    HighCVSS 7.8No exploitEPSS 0%

    jetbrains · intellij idea6 days ago

  • CVE-2026-123855
    30Monitor

    In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

    HighCVSS 7.5No exploitEPSS 0%

    jetbrains · toolbox app6 days ago

  • CVE-2026-123859
    32Monitor

    SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

    HighCVSS 8.1No exploitEPSS 0%

    snowflake · snowflake connector for python6 days ago

  • CVE-2026-123962
    33Monitor

    In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys f

    HighCVSS 8.4No exploitEPSS 0%

    debian · freedombox6 days ago

  • CVE-2026-62850
    21Monitor

    FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application s

    MediumCVSS 5.3Proof of conceptEPSS 0%

    freescout-help-desk · freescout6 days ago

  • CVE-2026-62854
    30Monitor

    FreeScout: Stored XSS in mailbox signature via same-origin JS upload

    HighCVSS 7.6No exploitEPSS 0%

    freescout-help-desk · freescout6 days ago

  • CVE-2026-62856
    30Monitor

    FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query

    HighCVSS 7.7No exploitEPSS 0%

    freescout-help-desk · freescout6 days ago

  • CVE-2026-85743
    32Monitor

    FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks

    HighCVSS 8.2No exploitEPSS 0%

    freescout-help-desk · freescout6 days ago

  • CVE-2026-102359
    30Monitor

    Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives

    HighCVSS 7.5No exploitEPSS 0%

    yuzutech · kroki6 days ago

  • CVE-2026-102650
    30Monitor

    Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

    HighCVSS 7.5No exploitEPSS 0%

    nuxt · content6 days ago

  • CVE-2026-118670
    35Monitor

    OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

    HighCVSS 8.8No exploitEPSS 0%

    ohif · viewers6 days ago

  • CVE-2026-119758
    28Monitor

    ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document

    HighCVSS 7.1No exploitEPSS 0%

    monogramm · erpnext_ocr6 days ago

  • CVE-2026-62344
    30Monitor

    Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints

    HighCVSS 7.5No exploitEPSS 0%

    open-wanderer · wanderer6 days ago

  • CVE-2026-85742
    30Monitor

    FreeScout: Conditional stored admin XSS via failed-job details

    HighCVSS 7.5No exploitEPSS 0%

    freescout-help-desk · freescout6 days ago

  • CVE-2026-89017
    34Monitor

    Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass

    HighCVSS 8.7No exploitEPSS 0%

    skyline communications · dataminer6 days ago

  • CVE-2026-100081
    31Monitor

    xen-netback: defer xenvif_mcast_addr_list_free()

    HighCVSS 7.8No exploitEPSS 0%

    linux · linux6 days ago

  • CVE-2026-107154
    35Monitor

    A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially e

    HighCVSS 8.8No exploitEPSS 0%

    sonicwall · sonicos6 days ago

  • CVE-2026-107155
    35Monitor

    A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could p

    HighCVSS 8.8No exploitEPSS 0%

    sonicwall · sonicos6 days ago

  • CVE-2026-119923
    37Monitor

    Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

    CriticalCVSS 9.3No exploitEPSS 0%

    aws · babelfish-for-postgresql6 days ago

  • CVE-2026-119924
    28Monitor

    Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser

    HighCVSS 7.2No exploitEPSS 0%

    aws · babelfish-for-postgresql6 days ago

  • CVE-2026-123356
    30Monitor

    GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)

    HighCVSS 7.5No exploitEPSS 0%

    grobidorg · grobid6 days ago

  • CVE-2026-123993
    34Monitor

    Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access

    HighCVSS 8.7No exploitEPSS 0%

    hisense · vidaa6 days ago

  • CVE-2026-123997
    28Monitor

    Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI

    HighCVSS 7.1No exploitEPSS 0%

    hisense · vidaa6 days ago

  • CVE-2026-123998
    28Monitor

    Hisense VIDAA Smart TV MQTT Broker Authentication Bypass

    HighCVSS 7.2No exploitEPSS 0%

    hisense · vidaa6 days ago

  • CVE-2026-19868
    60This week

    An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authenticatio

    HighCVSS 7.5KEVWeaponizedEPSS 0%

    sonicwall · sonicos6 days ago

  • CVE-2026-62345
    30Monitor

    Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)

    HighCVSS 7.6No exploitEPSS 0%

    open-wanderer · wanderer6 days ago

  • CVE-2026-62346
    30Monitor

    Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML

    HighCVSS 7.6No exploitEPSS 0%

    open-wanderer · wanderer6 days ago

  • CVE-2026-71495
    40Plan

    Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access

    CriticalCVSS 10.0No exploitEPSS 0%

    open-wanderer · wanderer6 days ago

  • CVE-2026-82308
    30Monitor

    A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially en

    HighCVSS 7.5No exploitEPSS 0%

    sonicwall · sonicos6 days ago

  • CVE-2026-84473
    39Monitor

    Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated r

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    kiteworks · owncloud6 days ago

  • CVE-2026-90975
    31Monitor

    A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interfa

    HighCVSS 7.8No exploitEPSS 0%

    realtek · rtusba64.sys6 days ago

  • CVE-2026-123974
    31Monitor

    pytorch/serve: Local privilege escalation through insecure temporary path

    HighCVSS 7.8No exploitEPSS 0%

    pytorch · torchserve6 days ago