Exploited and new serious CVEs: November 2026

DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

doramart · doracms2 days ago

libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver

• Memory safety

gphoto · libgphoto22 days ago

python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key

• Pre-auth
• Auth bypass
• Weak crypto

mpdavis · python-jose2 days ago

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

• Broken access control (IDOR)

dromara · jpom2 days ago

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

• Broken access control (IDOR)

dromara · jpom2 days ago

LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

• Broken access control (IDOR)

laradashboard · laradashboard2 days ago

Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

• RCE
• Path traversal

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

• Auth bypass

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor

• RCE
• Path traversal
• Command injection

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token

• RCE
• Command injection

control web panel · control web panel2 days ago

Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token

nlnet labs · krill2 days ago

Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

• Broken access control (IDOR)

nlnet labs · krill2 days ago

Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

• Broken access control (IDOR)

nlnet labs · krill2 days ago

NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

• Pre-auth

eclipse foundation · eclipse threadx2 days ago

Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode

• Local privilege escalation
• Memory safety

eclipse foundation · eclipse threadx2 days ago

Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

• RCE
• Command injection

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access

• Auth bypass
• Local privilege escalation

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API

• RCE
• Command injection

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

• SQL injection

control web panel · control web panel2 days ago

Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

• RCE
• Local privilege escalation
• Command injection

control web panel · control web panel2 days ago

Rancher meta proxy allowlist bypass leading to server-side request forgery

• SSRF

suse · rancher2 days ago

Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

suse · rancher2 days ago

coredump: hold RCU while releasing parked threads

linux · linux2 days ago

keys: Protect the type name while describing a key

• Local privilege escalation

linux · linux2 days ago

io_uring/waitid: prevent cancel reference wrap

linux · linux2 days ago

io_uring/waitid: own the request before clearing ->head

linux · linux2 days ago

tracing/histograms: Verify event_call identity when updating synth_event refcount

linux · linux2 days ago

tracing: Save the event file instead of the compatible histogram

linux · linux2 days ago

tracing: Reject incomplete event filter expressions

linux · linux2 days ago

tracing: Hold trace_types_lock when resetting last boot data from readers

linux · linux2 days ago

tracing: Hold trace_types_lock when updating modules in persistent instances

linux · linux2 days ago

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

linux · linux2 days ago

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

• Pre-auth

chainguard-forks · kaniko2 days ago

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module.

• Pre-auth
• Memory safety

2 days ago

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module.

• Pre-auth
• Denial of service

2 days ago

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, deve

• Pre-auth
• Denial of service

ethernut / egnite gmbh · nut/net tcp/ip stack2 days ago

Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules

• Auth bypass

suse · rancher2 days ago

Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

• Pre-auth

suse · rancher2 days ago

OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication D

• Pre-auth
• Memory safety
• Denial of service

2 days ago

FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

• XSS
• CSRF

fossbilling · fossbilling2 days ago

Template injection in the publishing component of awslabs Virtual Engineering Workbench

• RCE
• SSTI

aws · virtual-engineering-workbench2 days ago

Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3

• RCE
• File upload

dj-extensions.com · dj-classifieds extension for joomla2 days ago

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3

• Pre-auth
• SQL injection

dj-extensions.com · dj-classifieds extension for joomla2 days ago

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

• Pre-auth
• File upload

joomlaboat.com · custom tables extension for joomla2 days ago

An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker t

• Pre-auth
• Denial of service

2 days ago

Munshi Payment Bypass via Unauthenticated Webhook Endpoint

• Pre-auth
• Auth bypass

petpooja · munshi2 days ago

Munshi Broken Object Level Authorization via Invoice Deletion API

• Broken access control (IDOR)

petpooja · munshi2 days ago

Munshi Missing Authorization in Company Deletion API

• Broken access control (IDOR)

petpooja · munshi2 days ago

Munshi IDOR via Purchase Inquiry Thread Endpoint

• Broken access control (IDOR)

petpooja · munshi2 days ago

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

• Pre-auth
• Hard-coded credentials

petpooja · munshi2 days ago

psqlODBC large-object read overflows the application buffer

• Pre-auth
• Memory safety

postgresql · psqlodbc2 days ago

psqlODBC row cache overflow when a later FETCH changes the column count

• Pre-auth
• Memory safety

postgresql · psqlodbc2 days ago

psqlODBC ODBC escape parser stack buffer overflow

• Memory safety

postgresql · psqlodbc2 days ago

psqlODBC SQL injection through SQLSpecialColumns table and schema names

• RCE
• SQL injection

postgresql · psqlodbc2 days ago

psqlODBC does not validate column numbers and row indexes in binding and descriptor functions

postgresql · psqlodbc2 days ago

psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

• SQL injection

postgresql · psqlodbc2 days ago

Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir

• Path traversal

grafana · enterprise metrics (gem)2 days ago

In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack.

• Local privilege escalation

google · android2 days ago

In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack.

• Local privilege escalation

google · android2 days ago

In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation

• Local privilege escalation
• Broken access control (IDOR)

google · android2 days ago

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

• pre-auth RCE
• Deserialization

themefic · ultra addons for contact form 72 days ago

Authentication bypass in Secure Access Servers

• Pre-auth
• Auth bypass

absolute security · secure access2 days ago

Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket

• RCE
• Local privilege escalation
• Command injection

nexbox · a95x2 days ago

Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

• RCE
• Auth bypass
• Command injection

nexbox · a95x2 days ago

In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in th

• Local privilege escalation
• Broken access control (IDOR)

google · android2 days ago

In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation.

• Local privilege escalation

google · android2 days ago

In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation.

• Local privilege escalation

google · android2 days ago

In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code.

• Local privilege escalation

google · android2 days ago

In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy.

• Local privilege escalation

google · android2 days ago

In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code.

• Local privilege escalation

google · android2 days ago

In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy.

• Local privilege escalation

google · android2 days ago

In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation.

• Local privilege escalation

google · android2 days ago

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI.

• Local privilege escalation

google · android2 days ago

In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android2 days ago

In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due

• Local privilege escalation

google · android2 days ago

In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading o

• Local privilege escalation

google · android2 days ago

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.

• Local privilege escalation

google · android2 days ago

In multiple locations, there is a possible use-after-free due to a race condition.

• Local privilege escalation
• Memory safety
• Race condition

google · android2 days ago

In multiple locations, there is a possible memory safety issue due to a use-after-free.

• Local privilege escalation
• Memory safety

google · android2 days ago

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to m

• Local privilege escalation

google · android2 days ago

In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception.

• Local privilege escalation

google · android2 days ago

In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.

• Local privilege escalation

google · android2 days ago

In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow.

• Pre-auth
• Memory safety
• Denial of service

google · android2 days ago

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check.

• Local privilege escalation
• Memory safety

google · android2 days ago

In multiple functions of fork.c, there is a possible use after free due to a logic error in the code.

• Local privilege escalation
• Memory safety

google · android2 days ago

In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free.

• Local privilege escalation
• Memory safety

google · android2 days ago

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition.

• Local privilege escalation
• Memory safety
• Race condition

google · android2 days ago

In multiple functions of base.c, there is a possible use-after-free due to a race condition.

• Local privilege escalation
• Memory safety
• Race condition

google · android2 days ago

In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free.

• Local privilege escalation
• Memory safety

google · android2 days ago

In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that all

• Local privilege escalation

google · android2 days ago

In multiple locations, there is a possible background activity launch due to a logic error in the code.

• Local privilege escalation

google · android2 days ago

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check.

• Local privilege escalation
• Memory safety

google · android2 days ago

In multiple locations, there is a possible out of bounds write due to an integer overflow.

• Local privilege escalation
• Memory safety

google · android2 days ago

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code.

• Local privilege escalation

google · android2 days ago

In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check.

• Pre-auth
• Memory safety
• Denial of service

google · android2 days ago

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing p

• Local privilege escalation
• Broken access control (IDOR)

google · android2 days ago

In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android2 days ago

In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow.

• Local privilege escalation
• Memory safety

google · android2 days ago

In multiple locations, there is a possible memory safety issue due to a use-after-free.

• pre-auth RCE
• Memory safety

google · android2 days ago

In descramble of multiple files, there is a possible out-of-bounds write due to improper casting.

• Local privilege escalation
• Memory safety

google · android2 days ago