Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2026

3,408 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 35 of 35

  • CVE-2026-67546
    35Monitor

    Heym: Command execution via POST /api/mcp/fetch-tools stdio transport: supplied command is spawned before MCP validation

    HighCVSS 8.8No exploit

    heymrun · heymToday

  • CVE-2026-67547
    35Monitor

    taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime

    HighCVSS 8.8No exploit

    jaylfc · taosToday

  • CVE-2026-67548
    33Monitor

    taOS: Non-Admin Users Can Access System Settings and Update Actions

    HighCVSS 8.3No exploit

    jaylfc · taosToday

  • CVE-2026-68538
    30Monitor

    fulgur: Unbounded counters() expansion in generated content causes memory/CPU exhaustion (denial of service)

    HighCVSS 7.5No exploit

    fulgur-rs · fulgurToday

  • CVE-2026-68539
    30Monitor

    fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)

    HighCVSS 7.5No exploit

    fulgur-rs · fulgurToday

  • CVE-2026-68540
    30Monitor

    fulgur: Quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements causes denial of servicefulgur:

    HighCVSS 7.5No exploit

    fulgur-rs · fulgurToday

  • CVE-2026-81936
    28Monitor

    Default OpenBMC Root Credential Reintroduced After Reset to Defaults in ThinkSystem v4 XCC3

    HighCVSS 7.1No exploit

    lenovo · xclarity controllerToday

  • CVE-2026-125637
    28Monitor

    Konflux-ci: unvalidated hostname fields enable caddyfile config injection in the konflux ui proxy generator, allowing an unauthenticated route to be spliced ahe

    HighCVSS 7.2No exploit

    Today