Exploited and new serious CVEs: November 2026

Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Ca

amd · amd epyc™ 7003 series processorsToday

Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsani

amd · amd epyc™ 9005 series processorsToday

Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8

• Pre-auth
• Broken access control (IDOR)
• Info leak

jdownloads.com · jdownloads extension for joomlaToday

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1

• Broken access control (IDOR)

datasolution · acymailing extension for joomla and wordpressToday

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

• Path traversal

red hat · red hat enterprise linux 10Today

Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges,

• RCE
• Local privilege escalation

amd · vivado softwareToday

Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed

• Auth bypass

red hat · red hat satellite 6Today

Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions

red hat · red hat satellite 6Today

Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)

• Broken access control (IDOR)

red hat · red hat satellite 6Today

Candlepin: consumer certificate can register systems in another organization

• Broken access control (IDOR)

red hat · red hat satellite 6Today

Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username

• pre-auth RCE
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection

• RCE
• Local privilege escalation
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password

• Pre-auth
• Hard-coded credentials

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Predictable Administrator Password Generation

• Pre-auth
• Weak crypto

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Predictable Root Password Generation

• Pre-auth
• Hard-coded credentials

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field

• pre-auth RCE
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB EVO OS Command Injection via devices.lua

• RCE
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB EVO OS Command Injection via backup.lua

• RCE
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi

• pre-auth RCE
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass

• Pre-auth
• Auth bypass
• Hard-coded credentials

copeland · xweb evoToday

Dixell/Copeland XWEB EVO OS Command Injection via api.lua

• RCE
• Command injection

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Unauthenticated Configuration Write via config.lua

• Pre-auth
• Auth bypass

copeland · xweb evoToday

Dixell/Copeland XWEB EVO Authentication Bypass via users.lua

• Pre-auth
• Auth bypass

copeland · xweb evoToday

Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack

• Pre-auth
• Memory safety

bacnet-stack · bacnet-stackToday

BACnet Stack: NULL pointer dereference in bacnet_device_object_reference_decode() when WriteProperty updates Structured View subordinate-list

• Pre-auth
• Memory safety
• Denial of service

bacnet-stack · bacnet-stackToday

BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount

• Pre-auth
• Memory safety
• Denial of service

bacnet-stack · bacnet-stackToday

BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server

• Pre-auth
• Denial of service

bacnet-stack · bacnet-stackToday

BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success

bacnet-stack · bacnet-stackToday

BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding

• Pre-auth

bacnet-stack · bacnet-stackToday

BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding

• Pre-auth
• Memory safety

bacnet-stack · bacnet-stackToday

BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow

• Pre-auth
• Memory safety

bacnet-stack · bacnet-stackToday

BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server

• Pre-auth
• Memory safety

bacnet-stack · bacnet-stackToday

BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()

• Pre-auth

bacnet-stack · bacnet-stackToday

Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate

• Pre-auth

xyproto · algernonToday

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.

• Auth bypass

johnson controls · easyio fwToday

Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper

aws · aws-advanced-go-wrapperToday

datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation

• pre-auth RCE

datamodel-code-generator · datamodel-code-generatorToday

Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller

• Broken access control (IDOR)

red hat · red hat satellite 6Today

Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir

mongodb · atlas sql jdbc driverToday

MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route

• Broken access control (IDOR)

multivendorx · multivendorx – woocommerce multivendor marketplace ai powered solutionsToday

msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM

• Pre-auth
• Denial of service

msgpack · msgpack-rubyToday

Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data

• Pre-auth
• Denial of service

python-pillow · pillowToday

Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size

• Pre-auth
• Memory safety

python-pillow · pillowToday

msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM

• Pre-auth
• Denial of service

Today