Exploited and new serious CVEs: November 2026

In multiple locations, there is a possible use-after-free due to a race condition.

• Local privilege escalation
• Memory safety
• Race condition

google · android4 days ago

In multiple locations, there is a possible memory safety issue due to a use-after-free.

• Local privilege escalation
• Memory safety

google · android4 days ago

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to m

• Local privilege escalation

google · android4 days ago

In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception.

• Local privilege escalation

google · android4 days ago

In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow.

• Pre-auth
• Memory safety
• Denial of service

google · android4 days ago

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check.

• Local privilege escalation
• Memory safety

google · android4 days ago

In multiple functions of fork.c, there is a possible use after free due to a logic error in the code.

• Local privilege escalation
• Memory safety

google · android4 days ago

In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free.

• Local privilege escalation
• Memory safety

google · android4 days ago

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition.

• Local privilege escalation
• Memory safety
• Race condition

google · android4 days ago

In multiple functions of base.c, there is a possible use-after-free due to a race condition.

• Local privilege escalation
• Memory safety
• Race condition

google · android4 days ago

In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free.

• Local privilege escalation
• Memory safety

google · android4 days ago

In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that all

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible background activity launch due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check.

• Local privilege escalation
• Memory safety

google · android4 days ago

In multiple locations, there is a possible out of bounds write due to an integer overflow.

• Local privilege escalation
• Memory safety

google · android4 days ago

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check.

• Pre-auth
• Memory safety
• Denial of service

google · android4 days ago

In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition.

• pre-auth RCE
• Race condition

google · android4 days ago

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing p

• Local privilege escalation
• Broken access control (IDOR)

google · android4 days ago

In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android4 days ago

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow.

• pre-auth RCE
• Memory safety

google · android4 days ago

In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow.

• Local privilege escalation
• Memory safety

google · android4 days ago

In multiple locations, there is a possible memory safety issue due to a use-after-free.

• pre-auth RCE
• Memory safety

google · android4 days ago

In descramble of multiple files, there is a possible out-of-bounds write due to improper casting.

• Local privilege escalation
• Memory safety

google · android4 days ago

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow.

• Pre-auth
• Memory safety
• Denial of service

google · android4 days ago

In multiple locations, there is a possible denial of service due to a logic error in the code.

• Pre-auth
• Denial of service

google · android4 days ago

In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible permission bypass due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free.

• pre-auth RCE
• Memory safety

google · android4 days ago

In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation.

• Pre-auth
• Denial of service

google · android4 days ago

In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code.

• Local privilege escalation
• Memory safety

google · android4 days ago

In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused

• Local privilege escalation

google · android4 days ago

In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow.

• Pre-auth
• Memory safety
• Denial of service

google · android4 days ago

In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a logic error in the code

• Local privilege escalation

google · android4 days ago

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible denial of service due to improper input validation.

• Pre-auth
• Denial of service

google · android4 days ago

In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation.

• Local privilege escalation

google · android4 days ago

In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow.

• Local privilege escalation
• Memory safety

google · android4 days ago

In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free.

• Pre-auth
• Memory safety

google · android4 days ago

In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check.

• Local privilege escalation
• Memory safety

google · android4 days ago

In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible memory corruption due to a use-after-free.

• Local privilege escalation
• Memory safety

google · android4 days ago

In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android4 days ago

In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android4 days ago

In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android4 days ago

In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow.

• Local privilege escalation
• Memory safety

google · android4 days ago

In multiple locations, there is a possible permission bypass due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In multiple locations, there is a possible permission bypass due to an uncaught exception.

• Local privilege escalation

google · android4 days ago

In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android4 days ago

In multiple locations, there is a possible out-of-bounds write due to an integer overflow.

• Local privilege escalation
• Memory safety

google · android4 days ago

In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal.

• Path traversal
• Local privilege escalation

google · android4 days ago

In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.

• Local privilege escalation

google · android4 days ago

In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition.

• Local privilege escalation
• Race condition

google · android4 days ago

In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition.

• Local privilege escalation
• Race condition

google · android4 days ago

In multiple locations, there is a possible use-after-free due to a logic error in the code.

• Local privilege escalation
• Memory safety

google · android4 days ago

In multiple locations, there is a possible memory corruption due to a race condition.

• Local privilege escalation
• Race condition

google · android4 days ago

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability.

• Local privilege escalation

dell · alienware command center (awcc)4 days ago

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability.

• Local privilege escalation

dell · alienware command center (awcc)4 days ago

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability

• pre-auth RCE
• Weak crypto

dell · alienware command center (awcc)4 days ago

CSRF in Secure Access Server v14.60

• Pre-auth
• CSRF

absolute security · secure access4 days ago

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

• Pre-auth

webpros · cpanel4 days ago

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate pri

webpros · cpanel4 days ago

Improper input handling in Secure Access server

absolute software · secure access4 days ago

Improper input handling in Secure Access servers

absolute software · secure access4 days ago

Missing length validation in Absolute Secure Access

absolute software · secure access4 days ago

Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd.

• RCE
• Local privilege escalation

infinitt healthcare · system manager4 days ago

ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser

• RCE
• Memory safety

readymedia · readymedia (minidlna)4 days ago

An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `a

• Local privilege escalation

google · android4 days ago

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation
• Broken access control (IDOR)

google · android xr4 days ago

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method.

• Pre-auth
• Memory safety

google · android4 days ago

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from

• Local privilege escalation
• Memory safety

google · android4 days ago

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded

• Local privilege escalation

google · android4 days ago

NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

• Pre-auth
• Denial of service

eclipse foundation · eclipse threadx4 days ago

NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

• Pre-auth

eclipse foundation · eclipse threadx4 days ago

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

• RCE
• Command injection

temporal technologies, inc. · temporal server4 days ago

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

• pre-auth RCE

clavaque · s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions4 days ago

Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

• Pre-auth
• XSS

welcart · e-commerce plugin4 days ago

PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

• Memory safety

pymupdf · pymupdf4 days ago

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authe

• Auth bypass

johnson controls · easyio neo ec and cw edge controller4 days ago

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

• Pre-auth
• Memory safety

red hat · red hat enterprise linux 104 days ago

labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

• RCE
• Deserialization

nist · labbench4 days ago

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthen

• pre-auth RCE
• Memory safety

zyxel · gs1900-24e firmware4 days ago

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based att

• Pre-auth
• Memory safety

zyxel · nwa110ax firmware4 days ago

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

• pre-auth RCE
• Path traversal

kalengi · buddypress xprofile custom image field3 days ago

Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

• pre-auth RCE
• File upload

acf extended · advanced custom fields: extended pro3 days ago

Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

• Pre-auth
• Auth bypass

smub · easy digital downloads – ecommerce payments and subscriptions made easy3 days ago

Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter

• SQL injection

zorem · advanced shipment tracking for woocommerce3 days ago

Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

• pre-auth RCE
• Path traversal

satindersingh · contact form extender for divi – submissions db & extra fields3 days ago

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeove

• Pre-auth
• Auth bypass

surecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments3 days ago

FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

• RCE
• Path traversal

wpmanageninja · fluentcart a new era of ecommerce – faster, lighter, and simpler3 days ago