Exploited and new serious CVEs: November 2026
3,961 records · 10 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 21 of 40
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
34Monitor | CVE-2026-60035No exploit | Command injection in network authmb connect line · mbconnect24 · CWE-78 | High8.6 | — | 0.4% | 3 days ago |
34Monitor | CVE-2026-60036No exploit | Command injection in patch activatemb connect line · mbconnect24 · CWE-78 | High8.6 | — | 0.4% | 3 days ago |
34Monitor | CVE-2026-60037No exploit | OpenSSL command injection in device importermb connect line · mbconnect24 · CWE-78 | High8.6 | — | 0.4% | 3 days ago |
34Monitor | CVE-2026-60038No exploit | OpenSSL command injection in ImportPKCS12mb connect line · mbconnect24 · CWE-78 | High8.6 | — | 0.4% | 3 days ago |
34Monitor | CVE-2026-60039No exploit | Command injection in backup restoremb connect line · mbconnect24 · CWE-78 | High8.6 | — | 0.4% | 3 days ago |
34Monitor | CVE-2026-60040No exploit | DoS in backup creationmb connect line · mbconnect24 · CWE-770 | High8.7 | — | 0.3% | 3 days ago |
34Monitor | CVE-2026-60044No exploit | Static backup passwordmb connect line · mbconnect24 · CWE-1393 | High8.7 | — | 0.3% | 3 days ago |
34Monitor | CVE-2026-60046No exploit | DoS via password resetmb connect line · mbconnect24 · CWE-640 | High8.7 | — | 0.3% | 3 days ago |
31Monitor | CVE-2026-104619No exploit | PackageKit ZYpp rollback vulnerabilitypackagekit · packagekit · CWE-1328 | High7.8 | — | 0.1% | 3 days ago |
37Monitor | CVE-2026-119446No exploit | Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API tokennerves-hub · nerves_hub_web · CWE-384 | Critical9.4 | — | 0.4% | 3 days ago |
28Monitor | CVE-2026-120295No exploit | Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmwarenerves-hub · nerves_hub_web · CWE-863 | High7.1 | — | 0.2% | 3 days ago |
34Monitor | CVE-2026-120730No exploit | Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmwarenerves-hub · nerves_hub_web · CWE-639 | High8.6 | — | 0.3% | 3 days ago |
29Monitor | CVE-2026-120999No exploit | Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone elsenerves-hub · nerves_hub_web · CWE-287 | High7.4 | — | 0.2% | 3 days ago |
30Monitor | CVE-2026-125704No exploit | Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserializationred hat · red hat enterprise linux 10 · CWE-416 | High7.5 | — | 0.5% | 3 days ago |
33Monitor | CVE-2026-95646No exploit | Authenticated Command Injectionzohocorp · ddi central · CWE-77 | High8.0 | — | 3.8% | 3 days ago |
30Monitor | CVE-2026-95651No exploit | Authentication Bypasszohocorp · ddi central · CWE-306 | High7.5 | — | 1.3% | 3 days ago |
34Monitor | CVE-2026-109097No exploit | A vulnerability has been identified in ROS# (All versions < V2.3.1).siemens · ros# · CWE-94 | High8.6 | — | 0.1% | 3 days ago |
28Monitor | CVE-2026-109830No exploit | A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01).siemens · meta-iot2050 · CWE-78 | High7.0 | — | 0.1% | 3 days ago |
36Monitor | CVE-2026-112136No exploit | A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= siemens · mendix studio pro 11 · CWE-1327 | Critical9.2 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-123717No exploit | [Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Executioneclipse csi · otterdog · CWE-78 | High8.8 | — | 1.0% | 3 days ago |
28Monitor | CVE-2026-125707No exploit | Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset tablered hat · red hat enterprise linux 10 · CWE-787 | High7.1 | — | 0.1% | 3 days ago |
30Monitor | CVE-2026-125712No exploit | Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsingred hat · red hat enterprise linux 10 · CWE-125 | High7.5 | — | 0.5% | 3 days ago |
34Monitor | CVE-2026-125742No exploit | 7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction7-zip · 7-zip · CWE-787 | High8.5 | — | 0.1% | 3 days ago |
30Monitor | CVE-2026-12266No exploit | Authenticated Broken Access Controlzohocorp · ddi central · CWE-862 | High7.6 | — | 0.4% | 3 days ago |
29Monitor | CVE-2026-12572No exploit | Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to czohocorp · ddi central · CWE-89 | High7.2 | — | 3.3% | 3 days ago |
36Monitor | CVE-2026-12573No exploit | Authenticated Command Injectionzohocorp · ddi central · CWE-77 | High8.8 | — | 3.1% | 3 days ago |
32Monitor | CVE-2026-12574No exploit | Server-Side HTML Injectionzohocorp · ddi central · CWE-79 | High8.1 | — | 0.8% | 3 days ago |
30Monitor | CVE-2026-58114No exploit | A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Informatiosiemens · simatic batch v9.1 · CWE-1390 | High7.7 | — | 0.3% | 3 days ago |
34Monitor | CVE-2026-59082No exploit | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versionsiemens · simatic wincc v7.5 · CWE-357 | High8.5 | — | 0.1% | 3 days ago |
31Monitor | CVE-2026-121267No exploit | Incorrect Default Permissions Vulnerability in TÜBİTAK BİLGEM's eta-remotetübi̇tak bi̇lgem software technologies research institute · eta-remote · CWE-276 | High7.8 | — | 0.0% | 3 days ago |
30Monitor | CVE-2026-124747No exploit | Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file sizered hat · red hat enterprise linux 6 · CWE-787 | High7.5 | — | 0.2% | 3 days ago |
28Monitor | CVE-2026-16478No exploit | Arbitrary Package Installation in TÜBİTAK BİLGEM's pardus-nvidia-installertübi̇tak bi̇lgem software technologies research institute · pardus-nvidia-installer · CWE-183 | High7.0 | — | 0.1% | 3 days ago |
30Monitor | CVE-2026-120399No exploit | Flightctl-api: flightctl-remote-access: flightctl: unbounded tls handshake in conncontext can block accepting connectionsred hat · red hat edge manager 1 · CWE-1322 | High7.5 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124852No exploit | Incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124853No exploit | Sandbox escape due to incorrect boundary conditions in the Graphics: Text componentmozilla · firefox · CWE-119 | Critical9.6 | — | 0.4% | 3 days ago |
35Monitor | CVE-2026-124856No exploit | Incorrect boundary conditions in the Networking: HTTP componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124857No exploit | Use-after-free in the Graphics: Canvas2D componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124858No exploit | Use-after-free in the DOM: HTML Parser componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124859No exploit | Sandbox escape due to incorrect boundary conditions in the Storage: Cache API componentmozilla · firefox · CWE-120 | Critical9.6 | — | 0.4% | 3 days ago |
35Monitor | CVE-2026-124860No exploit | Use-after-free in the Audio/Video componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124861No exploit | Sandbox escape due to use-after-free in the Audio/Video: cubeb componentmozilla · firefox · CWE-416 | Critical9.6 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124862No exploit | Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124863No exploit | Use-after-free in the DOM: HTML Parser componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124864No exploit | Sandbox escape due to use-after-free in the DOM: Service Workers componentmozilla · firefox · CWE-416 | Critical9.6 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124865No exploit | Use-after-free in the Audio/Video componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124866No exploit | Use-after-free in the Layout componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124867No exploit | Use-after-free in the DOM: Editor componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124868No exploit | Incorrect boundary conditions in the DOM: Core & HTML componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124869No exploit | Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124870No exploit | Incorrect boundary conditions in the JavaScript: GC componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124871No exploit | Use-after-free in the DOM: HTML Parser componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124872No exploit | Use-after-free in the Cycle Collector componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124875No exploit | Incorrect boundary conditions in the DOM: CSS Object Model componentmozilla · firefox · CWE-120 | High8.8 | — | 0.4% | 3 days ago |
35Monitor | CVE-2026-124876No exploit | Use-after-free in the CSS Parsing and Computation componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124877No exploit | Use-after-free in the Layout: Positioned componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124878No exploit | Use-after-free in the Layout: Positioned componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124880No exploit | Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124881No exploit | Use-after-free in the CSS Parsing and Computation componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124882No exploit | Use-after-free in the CSS Parsing and Computation componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124883No exploit | Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124884No exploit | Use-after-free in the JavaScript: GC componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124885No exploit | Use-after-free in the Graphics: Text componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124887No exploit | Incorrect boundary conditions in the Layout: Text and Fonts componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124888No exploit | Incorrect boundary conditions in the Layout: Text and Fonts componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124889No exploit | Use-after-free in the CSS Parsing and Computation componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124890No exploit | Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124891No exploit | Incorrect boundary conditions in the DOM: Selection componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124892No exploit | Use-after-free in the JavaScript: GC componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124893No exploit | Use-after-free in the DOM: Workers componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124894No exploit | Use-after-free in the Networking: Cookies componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124895No exploit | Use-after-free in the Storage: localStorage & sessionStorage componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124897No exploit | Use-after-free in the JavaScript: GC componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124898No exploit | Use-after-free in the DOM: Editor componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124899No exploit | Use-after-free in the Layout: Text and Fonts componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124900No exploit | Sandbox escape due to use-after-free in the DOM: Service Workers componentmozilla · firefox · CWE-416 | Critical9.6 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124903No exploit | Sandbox escape due to use-after-free in the IPC componentmozilla · firefox · CWE-416 | Critical9.6 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124904No exploit | Use-after-free in the SVG componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124906No exploit | Use-after-free in the Graphics: WebRender componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124907No exploit | Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124908No exploit | Use-after-free in the CSS Parsing and Computation componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124915No exploit | Incorrect boundary conditions in the Graphics: WebGPU componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
38Monitor | CVE-2026-124917No exploit | Sandbox escape due to use-after-free in the Widget: Gtk componentmozilla · firefox · CWE-416 | Critical9.6 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124918No exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124919No exploit | Privilege escalation due to use-after-free in the WebRTC: Networking componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124922No exploit | Use-after-free in the CSS Transitions and Animations componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124924No exploit | Incorrect boundary conditions in the Graphics: WebRender componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124926No exploit | Incorrect boundary conditions in the WebRTC componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124932No exploit | Use-after-free in the Graphics componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124943No exploit | Use-after-free in the Layout componentmozilla · firefox · CWE-416 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124947No exploit | Incorrect boundary conditions in the Graphics componentmozilla · firefox · CWE-120 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124948No exploit | Incorrect boundary conditions, use-after-free in the Graphics componentmozilla · firefox · CWE-119 | High8.8 | — | 0.3% | 3 days ago |
35Monitor | CVE-2026-124952No exploit | Use-after-free in the Audio/Video componentmozilla · firefox · CWE-416 | High8.8 | — | 0.2% | 3 days ago |
34Monitor | CVE-2026-12708No exploit | Unbounded HTTP/3 Datagram flow map growth in tokio-quichecloudflare · tokio-quiche · CWE-401 | High8.7 | — | 0.3% | 3 days ago |
36Monitor | CVE-2026-82509No exploit | V Programming Language net.http TLS Certificate Validation Bypassvlang · v · CWE-295 | Critical9.1 | — | 0.2% | 3 days ago |
30Monitor | CVE-2026-113422No exploit | In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (avaieclipse foundation · eclipse kura · CWE-807 | High7.7 | — | 0.3% | 3 days ago |
28Monitor | CVE-2026-114359No exploit | Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives.eclipse foundation · eclipse kura · CWE-770 | High7.0 | — | 0.2% | 3 days ago |
30Monitor | GHSA-6qrw-m8cv-hcxfNo exploit | Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encodingCWE-347 | High7.5 | — | — | 3 days ago |
29Monitor | CVE-2026-105425Proof of concept | OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.ivanti · sentry · CWE-78 | High7.2 | — | 2.6% | 3 days ago |
38Monitor | CVE-2026-108186No exploit | Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network zoom communications · zoom workplace · CWE-20 | Critical9.6 | — | 0.4% | 3 days ago |
32Monitor | CVE-2026-108187No exploit | Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network aczoom communications · zoom workplace · CWE-346 | High8.1 | — | 0.1% | 3 days ago |
- CVE-2026-6003534Monitor
Command injection in network auth
HighCVSS 8.6No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6003634Monitor
Command injection in patch activate
HighCVSS 8.6No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6003734Monitor
OpenSSL command injection in device importer
HighCVSS 8.6No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6003834Monitor
OpenSSL command injection in ImportPKCS12
HighCVSS 8.6No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6003934Monitor
Command injection in backup restore
HighCVSS 8.6No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6004034Monitor
DoS in backup creation
HighCVSS 8.7No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6004434Monitor
Static backup password
HighCVSS 8.7No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-6004634Monitor
DoS via password reset
HighCVSS 8.7No exploitEPSS 0%mb connect line · mbconnect243 days ago
- CVE-2026-10461931Monitor
PackageKit ZYpp rollback vulnerability
HighCVSS 7.8No exploitEPSS 0%packagekit · packagekit3 days ago
- CVE-2026-11944637Monitor
Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
CriticalCVSS 9.4No exploitEPSS 0%nerves-hub · nerves_hub_web3 days ago
- CVE-2026-12029528Monitor
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
HighCVSS 7.1No exploitEPSS 0%nerves-hub · nerves_hub_web3 days ago
- CVE-2026-12073034Monitor
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
HighCVSS 8.6No exploitEPSS 0%nerves-hub · nerves_hub_web3 days ago
- CVE-2026-12099929Monitor
Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else
HighCVSS 7.4No exploitEPSS 0%nerves-hub · nerves_hub_web3 days ago
- CVE-2026-12570430Monitor
Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
HighCVSS 7.5No exploitEPSS 0%red hat · red hat enterprise linux 103 days ago
- CVE-2026-9564633Monitor
Authenticated Command Injection
HighCVSS 8.0No exploitEPSS 3%zohocorp · ddi central3 days ago
- CVE-2026-9565130Monitor
Authentication Bypass
HighCVSS 7.5No exploitEPSS 1%zohocorp · ddi central3 days ago
- CVE-2026-10909734Monitor
A vulnerability has been identified in ROS# (All versions < V2.3.1).
HighCVSS 8.6No exploitEPSS 0%siemens · ros#3 days ago
- CVE-2026-10983028Monitor
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01).
HighCVSS 7.0No exploitEPSS 0%siemens · meta-iot20503 days ago
- CVE-2026-11213636Monitor
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >=
CriticalCVSS 9.2No exploitEPSS 0%siemens · mendix studio pro 113 days ago
- CVE-2026-12371735Monitor
[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution
HighCVSS 8.8No exploitEPSS 1%eclipse csi · otterdog3 days ago
- CVE-2026-12570728Monitor
Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table
HighCVSS 7.1No exploitEPSS 0%red hat · red hat enterprise linux 103 days ago
- CVE-2026-12571230Monitor
Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing
HighCVSS 7.5No exploitEPSS 0%red hat · red hat enterprise linux 103 days ago
- CVE-2026-12574234Monitor
7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction
HighCVSS 8.5No exploitEPSS 0%7-zip · 7-zip3 days ago
- CVE-2026-1226630Monitor
Authenticated Broken Access Control
HighCVSS 7.6No exploitEPSS 0%zohocorp · ddi central3 days ago
- CVE-2026-1257229Monitor
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to c
HighCVSS 7.2No exploitEPSS 3%zohocorp · ddi central3 days ago
- CVE-2026-1257336Monitor
Authenticated Command Injection
HighCVSS 8.8No exploitEPSS 3%zohocorp · ddi central3 days ago
- CVE-2026-1257432Monitor
Server-Side HTML Injection
HighCVSS 8.1No exploitEPSS 0%zohocorp · ddi central3 days ago
- CVE-2026-5811430Monitor
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Informatio
HighCVSS 7.7No exploitEPSS 0%siemens · simatic batch v9.13 days ago
- CVE-2026-5908234Monitor
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All version
HighCVSS 8.5No exploitEPSS 0%siemens · simatic wincc v7.53 days ago
- CVE-2026-12126731Monitor
Incorrect Default Permissions Vulnerability in TÜBİTAK BİLGEM's eta-remote
HighCVSS 7.8No exploitEPSS 0%tübi̇tak bi̇lgem software technologies research institute · eta-remote3 days ago
- CVE-2026-12474730Monitor
Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size
HighCVSS 7.5No exploitEPSS 0%red hat · red hat enterprise linux 63 days ago
- CVE-2026-1647828Monitor
Arbitrary Package Installation in TÜBİTAK BİLGEM's pardus-nvidia-installer
HighCVSS 7.0No exploitEPSS 0%tübi̇tak bi̇lgem software technologies research institute · pardus-nvidia-installer3 days ago
- CVE-2026-12039930Monitor
Flightctl-api: flightctl-remote-access: flightctl: unbounded tls handshake in conncontext can block accepting connections
HighCVSS 7.5No exploitEPSS 0%red hat · red hat edge manager 13 days ago
- CVE-2026-12485235Monitor
Incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12485338Monitor
Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12485635Monitor
Incorrect boundary conditions in the Networking: HTTP component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12485735Monitor
Use-after-free in the Graphics: Canvas2D component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12485835Monitor
Use-after-free in the DOM: HTML Parser component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12485938Monitor
Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486035Monitor
Use-after-free in the Audio/Video component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486138Monitor
Sandbox escape due to use-after-free in the Audio/Video: cubeb component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486235Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486335Monitor
Use-after-free in the DOM: HTML Parser component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486438Monitor
Sandbox escape due to use-after-free in the DOM: Service Workers component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486535Monitor
Use-after-free in the Audio/Video component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486635Monitor
Use-after-free in the Layout component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486735Monitor
Use-after-free in the DOM: Editor component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486835Monitor
Incorrect boundary conditions in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12486935Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487035Monitor
Incorrect boundary conditions in the JavaScript: GC component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487135Monitor
Use-after-free in the DOM: HTML Parser component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487235Monitor
Use-after-free in the Cycle Collector component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487535Monitor
Incorrect boundary conditions in the DOM: CSS Object Model component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487635Monitor
Use-after-free in the CSS Parsing and Computation component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487735Monitor
Use-after-free in the Layout: Positioned component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12487835Monitor
Use-after-free in the Layout: Positioned component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488035Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488135Monitor
Use-after-free in the CSS Parsing and Computation component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488235Monitor
Use-after-free in the CSS Parsing and Computation component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488335Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488435Monitor
Use-after-free in the JavaScript: GC component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488535Monitor
Use-after-free in the Graphics: Text component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488735Monitor
Incorrect boundary conditions in the Layout: Text and Fonts component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488835Monitor
Incorrect boundary conditions in the Layout: Text and Fonts component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12488935Monitor
Use-after-free in the CSS Parsing and Computation component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489035Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489135Monitor
Incorrect boundary conditions in the DOM: Selection component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489235Monitor
Use-after-free in the JavaScript: GC component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489335Monitor
Use-after-free in the DOM: Workers component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489435Monitor
Use-after-free in the Networking: Cookies component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489535Monitor
Use-after-free in the Storage: localStorage & sessionStorage component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489735Monitor
Use-after-free in the JavaScript: GC component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489835Monitor
Use-after-free in the DOM: Editor component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12489935Monitor
Use-after-free in the Layout: Text and Fonts component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12490038Monitor
Sandbox escape due to use-after-free in the DOM: Service Workers component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12490338Monitor
Sandbox escape due to use-after-free in the IPC component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12490435Monitor
Use-after-free in the SVG component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12490635Monitor
Use-after-free in the Graphics: WebRender component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12490735Monitor
Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12490835Monitor
Use-after-free in the CSS Parsing and Computation component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12491535Monitor
Incorrect boundary conditions in the Graphics: WebGPU component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12491738Monitor
Sandbox escape due to use-after-free in the Widget: Gtk component
CriticalCVSS 9.6No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12491835Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12491935Monitor
Privilege escalation due to use-after-free in the WebRTC: Networking component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12492235Monitor
Use-after-free in the CSS Transitions and Animations component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12492435Monitor
Incorrect boundary conditions in the Graphics: WebRender component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12492635Monitor
Incorrect boundary conditions in the WebRTC component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12493235Monitor
Use-after-free in the Graphics component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12494335Monitor
Use-after-free in the Layout component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12494735Monitor
Incorrect boundary conditions in the Graphics component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12494835Monitor
Incorrect boundary conditions, use-after-free in the Graphics component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-12495235Monitor
Use-after-free in the Audio/Video component
HighCVSS 8.8No exploitEPSS 0%mozilla · firefox3 days ago
- CVE-2026-1270834Monitor
Unbounded HTTP/3 Datagram flow map growth in tokio-quiche
HighCVSS 8.7No exploitEPSS 0%cloudflare · tokio-quiche3 days ago
- CVE-2026-8250936Monitor
V Programming Language net.http TLS Certificate Validation Bypass
CriticalCVSS 9.1No exploitEPSS 0%vlang · v3 days ago
- CVE-2026-11342230Monitor
In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (avai
HighCVSS 7.7No exploitEPSS 0%eclipse foundation · eclipse kura3 days ago
- CVE-2026-11435928Monitor
Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives.
HighCVSS 7.0No exploitEPSS 0%eclipse foundation · eclipse kura3 days ago
- GHSA-6qrw-m8cv-hcxf30Monitor
Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
HighCVSS 7.5No exploit3 days ago
- CVE-2026-10542529Monitor
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.
HighCVSS 7.2Proof of conceptEPSS 2%ivanti · sentry3 days ago
- CVE-2026-10818638Monitor
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network
CriticalCVSS 9.6No exploitEPSS 0%zoom communications · zoom workplace3 days ago
- CVE-2026-10818732Monitor
Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network ac
HighCVSS 8.1No exploitEPSS 0%zoom communications · zoom workplace3 days ago