Exploited and new serious CVEs: November 2026

Adobe Connect | Incorrect Authorization (CWE-863)

• Broken access control (IDOR)

adobe · adobe connect1 day ago

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

• XSS

adobe · adobe connect1 day ago

The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, a

• Pre-auth

kong inc. · kong gateway enterprise1 day ago

AsiaInfo Business Support System (BSS) Missing Authentication

• Pre-auth
• Auth bypass

asiainfo international · business support system1 day ago

AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

• Pre-auth
• Weak crypto

asiainfo international · business support system1 day ago

Multiple OGNL Injection vulnerabilities

• XSS

n-able · n-central1 day ago

Local privilege escalation to root via nable-writable syslog-ng config

n-able · n-central1 day ago

Stored XSS via MMS3 patch metadata (admin context)

• XSS

n-able · n-central1 day ago

Schema-hint SSRF via service import schema validation

• Pre-auth
• SSRF

n-able · n-central1 day ago

RCE via file repository upload path traversal

• RCE
• Path traversal

n-able · n-central1 day ago

Multiple XXE Vulnerabilities

• Pre-auth
• XXE

n-able · n-central1 day ago

Root RCE via unsigned NSP upgrade package upload

• RCE

n-able · n-central1 day ago

BeeS ERP administrative console IDOR

• Broken access control (IDOR)

bees software solutions · erp1 day ago

Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing

• RCE

rails · rails1 day ago

Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write

• Pre-auth
• Memory safety

zephyrproject · zephyr1 day ago

Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length

• Pre-auth
• Memory safety

zephyrproject · zephyr1 day ago

Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt

• Pre-auth
• Auth bypass

xtemos · basel post types1 day ago

Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode

• Memory safety

zephyrproject · zephyr1 day ago

Insecure IPC Channels lead to local privilege escalation

• Auth bypass
• Local privilege escalation

n-able · n-central1 day ago

The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provi

• Pre-auth
• Auth bypass

kong inc. · kong gateway enterprise1 day ago

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex

• Pre-auth

kong inc. · kong gateway enterprise1 day ago

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cache

• Pre-auth

kong inc. · kong gateway enterprise1 day ago

The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Pr

• Pre-auth

kong inc. · kong gateway enterprise1 day ago

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key

• Pre-auth

kong inc. · kong gateway enterprise1 day ago

The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allo

• Pre-auth

kong inc. · kong gateway enterprise1 day ago

Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unau

• Weak crypto

amd · amd epyc™ 7003 series processors1 day ago

React: Unauthenticated Remote Code Execution in React Server Components

• pre-auth RCE
• Deserialization

react · react1 day ago

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, F

• Pre-auth
• Broken access control (IDOR)

fortinet · fortimanager1 day ago

Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability

• Local privilege escalation
• Broken access control (IDOR)

Today

LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage

• Memory safety

librecad · librecadToday

Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints

• Pre-auth
• Path traversal

jellyfin · jellyfinToday

Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

• Pre-auth

directus · directusToday

WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

• Broken access control (IDOR)

wwbn · avideoToday

WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

• Pre-auth
• Auth bypass

wwbn · avideoToday

WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

• Pre-auth

wwbn · avideoToday

LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes

• SQL injection

limesurvey · limesurvey community editionToday

Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation

• Broken access control (IDOR)

semanticmediawiki · semanticmediawikiToday

Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

• Broken access control (IDOR)

semanticmediawiki · semanticmediawikiToday

Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

• Prototype pollution

padloc · padlocToday

Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil

• SQL injection

bahmni · bahmni-coreToday

Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

• Pre-auth
• Path traversal

bahmni · bahmni-coreToday

node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF

• Memory safety

mapbox · node-fontnikToday

Akaunting 3.3.0 - Stored XSS through imported item names

• XSS

akaunting · akauntingToday

pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset

mcdope · pam_usbToday

pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients

• Pre-auth
• Broken access control (IDOR)

mcdope · pam_usbToday

pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients

• Pre-auth
• Broken access control (IDOR)

mcdope · pam_usbToday

Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

• Pre-auth
• XSS

walinejs · walineToday

Stored XSS in the @waline/client UserList widget via an unescaped commenter link field

• Pre-auth
• XSS

walinejs · walineToday

Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path

• Pre-auth
• Deserialization

nitrite · nitrite-javaToday

AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

• Pre-auth
• Hard-coded credentials

nauelg · astro-blocksToday

User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass

• Pre-auth

unknown · user registration & membershipToday

Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable

• Pre-auth

unknown · forminator formsToday

PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass

• Pre-auth
• Auth bypass

unknown · printaura-woocommerceToday

Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path

• Path traversal

unknown · pay with a tweetToday

Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion

• Path traversal

unknown · somatic frameworkToday

Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File Replacement

• RCE
• File upload

unknown · contest galleryToday

Askany < 2.2.0 - Unauthenticated Arbitrary File Upload

• pre-auth RCE
• File upload

unknown · askanyToday

Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action

• Pre-auth
• XSS

unknown · knowledge buildingToday

Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply Response

• Pre-auth
• XSS

unknown · knowledge buildingToday

Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token

unknown · simpler checkoutToday

iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR

• Broken access control (IDOR)

unknown · ichartToday

Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSS

• Pre-auth
• XSS

unknown · smoove abandoned cart trigger for woocommerceToday

Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure

• Pre-auth

unknown · security for woocommerceToday

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset

• Broken access control (IDOR)

unknown · security for woocommerceToday

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure

• Broken access control (IDOR)

unknown · security for woocommerceToday

Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion

• Pre-auth
• Broken access control (IDOR)

unknown · security for woocommerceToday

In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of p

octopus deploy · octopus serverToday

In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login

• Broken access control (IDOR)

octopus deploy · octopus serverToday

ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header

• pre-auth RCE
• File upload

Today

Authenticated SQL Injection

• SQL injection

zohocorp · adaudit plusToday

ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header

• Pre-auth
• XSS

Today

ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter

• Pre-auth
• Deserialization
• XSS

Today

Authenticated Second-Order SQL Injection

• SQL injection

zohocorp · adaudit plusToday

In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project t

• Broken access control (IDOR)

octopus deploy · octopus serverToday

Uncontrolled Search Path Element in hMailServer

progressive robot ltd · hmailserverToday

Improper Certificate Validation in hMailServer

• Weak crypto

progressive robot ltd · hmailserverToday

Improper Certificate Validation in hMailServer

• Pre-auth
• Weak crypto

progressive robot ltd · hmailserverToday

Improper Certificate Validation in hMailServer

• Weak crypto

progressive robot ltd · hmailserverToday

Improper Link Resolution Before File Access ('Link Following') in hMailServer

progressive robot ltd · hmailserverToday

Allocation of Resources Without Limits or Throttling in hMailServer

• Pre-auth
• Denial of service

progressive robot ltd · hmailserverToday

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in hMailServer

• SQL injection

progressive robot ltd · hmailserverToday

Improper Certificate Validation in hMailServer

• Weak crypto

progressive robot ltd · hmailserverToday

Incorrect Default Permissions in hMailServer

progressive robot ltd · hmailserverToday

Inefficient Algorithmic Complexity in hMailServer

• Pre-auth
• Denial of service

progressive robot ltd · hmailserverToday

Unverified Ownership in hMailServer

progressive robot ltd · hmailserverToday

Insufficient IOCTL access control allows local access to I/O ports

• Local privilege escalation

beckhoff automation · tcrouter.sys for windows on x64 3.1.0.2364Today

Insufficient IOCTL access control allows local access to arbitrary physical memory

• Local privilege escalation

beckhoff automation · tcrouter.sys for windows on x64 3.1.0.2364Today

Insufficient IOCTL access control allows local relocation of arbitrary physical memory

• Local privilege escalation

beckhoff automation · tcrouter.sys for windows on x64 3.1.0.2364Today

Privilege escalation in Enter’s Iperius Backup

• Local privilege escalation

enter · iperius backupToday

WordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

ayecode ltd · geodirectoryToday

Busybox: heap buffer overflow in the tftp client on fallback to the default block size

• pre-auth RCE
• Memory safety

red hat · red hat enterprise linux 6Today

Path traversal in host label synchronization allows code execution on the central site from a remote site

• Path traversal

checkmk gmbh · checkmkToday

Arbitrary file write and code execution via crafted Synthetic Monitoring agent data

• Path traversal

checkmk gmbh · checkmkToday

Arbitrary file write and code execution via excluded node roles in Kubernetes special agent

checkmk gmbh · checkmkToday

WordPress AI Engine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

meow apps · ai engineToday

WordPress Calculated Fields Form plugin <= 5.5.2.8 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

codepeople · calculated fields formToday

Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf

• RCE
• Memory safety

red hat · red hat enterprise linux 6Today

Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()

• pre-auth RCE
• Memory safety

red hat · red hat enterprise linux 6Today

WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability

• pre-auth RCE

staggs · staggsToday

6Storage Rentals <= 2.31.0 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoni

• Auth bypass

sixstorage · 6storage rentalsToday