Exploited and new serious CVEs: November 2026

SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user

• Auth bypass

supertokens · supertokens-core2 days ago

SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries

• Broken access control (IDOR)

supertokens · supertokens-core2 days ago

ION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm_mgr AMP Rendering

• Pre-auth
• Memory safety

nasa-jpl · ion-dtn2 days ago

ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR

• pre-auth RCE
• Memory safety

nasa-jpl · ion-dtn2 days ago

FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI_BRUN Byte Swap

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 Heap Overflow via vulkan_av1.c

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Overflow in libaribcaption Text Subtitle Decoding

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode_apng()

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via cbs_jpeg_write_scan Integer Overflow

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit_frame()

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c

• Memory safety

ffmpeg · ffmpeg2 days ago

Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation

red hat · red hat fuse 72 days ago

rConfig Core 8.2.3 < 8.2.13 Cleartext Credential Exposure via API

• Broken access control (IDOR)

rconfig · rconfig2 days ago

SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS)

• Pre-auth
• Memory safety
• Denial of service

sipsorcery-org · sipsorcery2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder

• Memory safety

ffmpeg · ffmpeg2 days ago

FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c

• Memory safety

ffmpeg · ffmpeg2 days ago

zizmor: Debug logging prints available GitHub credentials in cleartext

• Info leak

zizmorcore · zizmor2 days ago

AsyncSSH: SFTPServer Chroot Escape

• Path traversal

ronf · asyncssh2 days ago

An authorization issue was addressed with improved validation.

• Pre-auth
• Broken access control (IDOR)

apple · ios and ipados2 days ago

A use-after-free issue was addressed with improved memory management.

• Pre-auth
• Memory safety

apple · ios and ipados2 days ago

Local privilege escalation via insecure folder permissions

• Local privilege escalation

illumio · core ven2 days ago

Local privilege escalation via untrusted OpenSSL configuration

• RCE
• Local privilege escalation

illumio · core ven2 days ago

TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column

• Broken access control (IDOR)

trailbaseio · trailbase2 days ago

Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service

• Memory safety

red hat · red hat enterprise linux 102 days ago

Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution

• pre-auth RCE
• Path traversal

signalk · signalk-server2 days ago

Dynatrace MCP Server: Unauthenticated HTTP MCP Tool Invocation in `@dynatrace-oss/dynatrace-mcp-server`

• Pre-auth
• Auth bypass

dynatrace-oss · dynatrace-mcp2 days ago

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyload · pyload2 days ago

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

• Path traversal

pyload · pyload2 days ago

pyLoad: Authentication bypass in API key validation (check_apikey cache)

• Pre-auth
• Auth bypass

pyload · pyload2 days ago

AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads

• Pre-auth
• Denial of service

aio-libs · aiohttp2 days ago

LMDeploy URL parser disagreement permits SSRF filter bypass

• Pre-auth
• SSRF

internlm · lmdeploy2 days ago

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

• Pre-auth
• Memory safety
• Denial of service

julianhille · muhammarajs2 days ago

Rack: Multipart parsing allows DoS via unbounded scan buffer growth

• Pre-auth
• Denial of service

rack · rack2 days ago

Replicate Cog 0.23.1 SSRF via cog.File and cog.Path URL Inputs

• SSRF

replicate · cog2 days ago

augment-vir: Shell Command Injection in `grep()` via Unsanitized `searchPattern`

• RCE
• Command injection

electrovir · augment-vir2 days ago

bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an Unauthorized Actor in

• Pre-auth

xddxdd · bird-lg-go2 days ago

ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability

• Pre-auth
• Memory safety
• Denial of service

owasp-modsecurity · modsecurity2 days ago

apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing

• RCE
• Local privilege escalation

canonical · apport2 days ago

Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes

• Local privilege escalation
• Memory safety

zephyrproject · zephyr2 days ago

NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop

• Pre-auth
• Memory safety
• Denial of service

zephyrproject · zephyr2 days ago

SQL injection leading to privilege escalation

• Pre-auth
• SQL injection

craftcms · cms2 days ago

Unsafe reflection in Amazon Braket Schemas error mitigation validation

• RCE

amazon · amazon-braket-schemas2 days ago

Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

• SSRF

novuhq · novu2 days ago

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema s

• Pre-auth
• Prototype pollution

automattic · mongoose2 days ago

Mongoose: Connection-level sanitizeFilter not applied

• Pre-auth
• SQL injection

automattic · mongoose2 days ago

Mongoose: sanitizeFilter not applied on countDocuments

• Pre-auth
• SQL injection

automattic · mongoose2 days ago

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the

• Pre-auth

2 days ago

Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment

southclaws · storyden2 days ago

Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon

• Auth bypass

2 days ago

frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController

frab · frab2 days ago

DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other use

• Broken access control (IDOR)

2 days ago

OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist

• Pre-auth

yeqing17-2026 · omniagent2 days ago

Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

• Pre-auth
• Auth bypass
• Hard-coded credentials

kubero-dev · kubero2 days ago

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-manage

• Broken access control (IDOR)

2 days ago

DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test

• Broken access control (IDOR)

gcpaas · dataroom2 days ago

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators hol

2 days ago

INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused b

• Pre-auth
• Auth bypass
• Hard-coded credentials

2 days ago

INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder

• Pre-auth
• Hard-coded credentials

go2ismail · asp.net-core-inventory-order-management-system2 days ago

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the d

• Path traversal

2 days ago

Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download

• Broken access control (IDOR)

intermesh · group-office2 days ago

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUpl

• Path traversal

2 days ago

Webmin through 2.670 OS Command Injection via Samba User Account Options

• RCE
• Command injection

webmin · webmin2 days ago

MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated u

• Memory safety

2 days ago

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt()

• Pre-auth
• Memory safety

2 days ago

Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery

• RCE
• Local privilege escalation

artifexsoftware · ghostpdl2 days ago

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated

• Broken access control (IDOR)

2 days ago

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level

• Broken access control (IDOR)

2 days ago

Fluxion before 6.39 OS Command Injection via Crafted SSID

• pre-auth RCE
• Command injection

fluxionnetwork · fluxion2 days ago

Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

• Pre-auth
• Memory safety

ettercap · ettercap2 days ago

Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 by

• Pre-auth
• Memory safety

2 days ago

Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the

• Pre-auth
• Memory safety

2 days ago

Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts

• Pre-auth
• Memory safety

ettercap · ettercap2 days ago

Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

• Pre-auth
• Memory safety

ettercap · ettercap2 days ago

Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NT

• Pre-auth
• Memory safety

2 days ago

Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decreme

• Pre-auth

2 days ago