By publication date

Exploited and new serious CVEs: November 2026

1,226 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 4 of 13

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-77799No exploit	Two-factor authentication bypasszohocorp · manageengine key manager plus · CWE-288 Pre-auth Auth bypass	High7.4	—	1.1%	3 days ago
30Monitor	CVE-2026-77800No exploit	Authentication bypass vulnerabilityzohocorp · manageengine key manager plus · CWE-304 Pre-auth Auth bypass	High7.7	—	0.9%	3 days ago
30Monitor	CVE-2026-120987No exploit	Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.naver · naver whale browser · CWE-346 Pre-auth	High7.5	—	0.1%	3 days ago
36Monitor	CVE-2026-13594No exploit	Improper Access Control vulnerabilityzohocorp · log360 · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	1.1%	3 days ago
30Monitor	CVE-2026-16900No exploit	Authentication Bypasszohocorp · log360 · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High7.5	—	1.5%	3 days ago
39Monitor	CVE-2026-4052No exploit	Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)wso2 · wso2 api manager · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	3 days ago
30Monitor	CVE-2026-74846No exploit	Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifierCWE-208 Pre-auth	High7.5	—	0.2%	3 days ago
34Monitor	CVE-2026-105978No exploit	Command Injection in Management Control Functionswelotec · tk100 · CWE-78 RCE Command injection	High8.6	—	0.3%	3 days ago
34Monitor	CVE-2026-105979No exploit	Command Injection in ZeroTier VPNwelotec · tk100 · CWE-77 RCE Command injection	High8.6	—	0.3%	3 days ago
34Monitor	CVE-2026-105980No exploit	Command Injection in WireGuard VPNwelotec · tk100 · CWE-77 RCE Command injection	High8.6	—	0.3%	3 days ago
34Monitor	CVE-2026-105981No exploit	Command Injection in Digital I/Owelotec · tk100 · CWE-78 RCE Command injection	High8.6	—	0.3%	3 days ago
34Monitor	CVE-2026-105982No exploit	Command Injection in IPsec VPNwelotec · tk100 · CWE-77 RCE Command injection	High8.6	—	0.4%	3 days ago
29Monitor	CVE-2026-113421No exploit	ThreadX Modules invokes trace-full callbacks after module unloadeclipse foundation · eclipse threadx · CWE-416 Local privilege escalation Memory safety	High7.3	—	0.1%	3 days ago
34Monitor	CVE-2026-115231No exploit	User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilegeeclipse foundation · eclipse threadx · CWE-269 Local privilege escalation	High8.5	—	0.1%	3 days ago
36Monitor	CVE-2026-121022No exploit	Default Administrator Password Change Not Enforced in Axxon One Web Clientaxxonsoft · axxon one · CWE-1393 Pre-auth Hard-coded credentials	Critical9.2	—	0.3%	3 days ago
39Monitor	CVE-2026-92610No exploit	Improper limitation of paths in py-aspect-model-loadereclipse foundation · eclipse semantic modeling framework (esmf) · CWE-22 Pre-auth Path traversal	Critical9.8	—	0.1%	3 days ago
30Monitor	CVE-2026-119724No exploit	Apache JClouds: XML External Entity (XXE) in provider-response parsingapache software foundation · apache jclouds · CWE-776 Pre-auth XXE	High7.5	—	0.2%	3 days ago
28Monitor	CVE-2026-120330No exploit	Broken Access Control in extension "Mail" (mail)typo3 · extension "mail" · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	3 days ago
35Monitor	CVE-2026-120333No exploit	Broken Access Control in extension "Frontend User Registration" (sf_register)typo3 · extension "frontend user registration" · CWE-639 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	3 days ago
32Monitor	CVE-2026-77691No exploit	Command injection vulnerabilityzohocorp · manageengine key manager plus · CWE-78 RCE Command injection	High8.1	—	1.3%	3 days ago
28Monitor	CVE-2026-77777No exploit	Improper access control vulnerabilityzohocorp · manageengine key manager plus · CWE-1220	High7.1	—	0.7%	3 days ago
28Monitor	CVE-2026-77778No exploit	Improper access control vulnerabilityzohocorp · manageengine key manager plus · CWE-1220	High7.1	—	0.3%	3 days ago
36Monitor	CVE-2026-89292No exploit	Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructureseclipse foundation · eclipse mnestix · CWE-522 Pre-auth SSRF Info leak	Critical9.2	—	0.4%	3 days ago
35Monitor	CVE-2026-89293No exploit	Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingeclipse foundation · eclipse mnestix · CWE-602 Pre-auth	High8.8	—	0.4%	3 days ago
31Monitor	GHSA-9fm9-c4h4-8g93No exploit	Out-of-bounds read when decoding internal keys shorter than 16 bytes	High7.9	—	—	3 days ago
31Monitor	GHSA-m9qr-4rcq-3jhcNo exploit	Data race and double free via unsound `Send`/`Sync` in `reblessive`	High7.8	—	—	3 days ago
32Monitor	CVE-2026-99246No exploit	tipc: protect node reset trace dump with node locklinux · linux Pre-auth	High8.1	—	0.4%	3 days ago
31Monitor	CVE-2026-99269No exploit	sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQslinux · linux	High7.8	—	0.1%	3 days ago
34Monitor	CVE-2026-108047No exploit	Inadequate authorization vulnerability in Alosuite’s user invitation functionalityam system · alo suite · CWE-285 Broken access control (IDOR)	High8.6	—	0.2%	3 days ago
28Monitor	CVE-2026-121458No exploit	Instatic before 0.0.21 Authorization Bypass via MCP Content Read Toolscorebunch · instatic · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	3 days ago
35Monitor	CVE-2026-76124No exploit	BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpointbuddyboss · buddyboss app · CWE-434 RCE File upload Race condition	High8.8	—	0.4%	3 days ago
32Monitor	CVE-2026-99270No exploit	tcp: Fix potential UAF in reqsk_timer_handler().linux · linux Pre-auth	High8.1	—	0.3%	3 days ago
33Monitor	CVE-2026-119179No exploit	MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's datamongodb · node.js driver · CWE-226 Pre-auth	High8.3	—	0.3%	3 days ago
35Monitor	CVE-2026-119742No exploit	Nagios XI < 2026R2 OS Command Injection via mibs.phpnagios enterprises, llc · nagios xi · CWE-78 RCE Command injection	High8.6	—	4.0%	3 days ago
35Monitor	CVE-2026-120572No exploit	Incorrect boundary conditions in the Layout: Block and Inline componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.8	—	0.3%	3 days ago
35Monitor	CVE-2026-85035No exploit	Use-after-free via dynamically allocated message queue retained by the CAN RX filterzephyrproject · zephyr · CWE-416 Local privilege escalation Memory safety	High8.8	—	0.2%	3 days ago
30Monitor	CVE-2026-89295No exploit	Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parametereclipse foundation · eclipse mnestix · CWE-770 Pre-auth Denial of service	High7.5	—	0.2%	3 days ago
28Monitor	CVE-2026-106991Proof of concept	hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.	High7.1	—	0.4%	3 days ago
30Monitor	CVE-2026-118489No exploit	CachingWebClient shares user-specific HTTP responses across users via the shared cache tiereclipse foundation · eclipse vert.x · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	3 days ago
47Plan	CVE-2026-118527Weaponized	Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to uploadivanti · connect secure · CWE-340	Medium4.3	KEV	0.8%	3 days ago
34Monitor	CVE-2026-121386No exploit	FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readersfreerdp · freerdp · CWE-248 Pre-auth	High8.7	—	0.2%	3 days ago
28Monitor	CVE-2026-121388No exploit	FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRSTfreerdp · freerdp · CWE-770 Pre-auth Denial of service	High7.1	—	0.3%	3 days ago
36Monitor	CVE-2026-121392No exploit	FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificatefreerdp · freerdp · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.1%	3 days ago
28Monitor	CVE-2026-121393No exploit	FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertionfreerdp · freerdp · CWE-617 Pre-auth	High7.1	—	0.3%	3 days ago
28Monitor	CVE-2026-121394No exploit	FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoderfreerdp · freerdp · CWE-617 Pre-auth	High7.1	—	0.2%	3 days ago
28Monitor	CVE-2026-121395No exploit	FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoderfreerdp · freerdp · CWE-617 Pre-auth	High7.1	—	0.2%	3 days ago
32Monitor	CVE-2026-121398No exploit	FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Modulefreerdp · freerdp · CWE-416 Pre-auth Memory safety	High8.2	—	0.2%	3 days ago
28Monitor	CVE-2026-121400No exploit	FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packetfreerdp · freerdp · CWE-835 Pre-auth Denial of service	High7.1	—	0.3%	3 days ago
28Monitor	CVE-2026-121402No exploit	FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphicsfreerdp · freerdp · CWE-476 Pre-auth Memory safety	High7.1	—	0.2%	3 days ago
28Monitor	CVE-2026-121404No exploit	FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATAfreerdp · freerdp · CWE-400 Denial of service	High7.1	—	0.3%	3 days ago
28Monitor	CVE-2026-121407No exploit	FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channelfreerdp · freerdp · CWE-20	High7.1	—	0.3%	3 days ago
32Monitor	CVE-2026-121409No exploit	FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Tokenfreerdp · freerdp · CWE-617 Pre-auth	High8.2	—	0.3%	3 days ago
28Monitor	CVE-2026-121412No exploit	FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassemblyfreerdp · freerdp · CWE-770 Denial of service	High7.1	—	0.3%	3 days ago
32Monitor	CVE-2026-121414No exploit	Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Updateparse-community · parse-server · CWE-248 Pre-auth	High8.2	—	0.3%	3 days ago
28Monitor	CVE-2026-121416No exploit	SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocationssurrealdb · surrealdb · CWE-284 Broken access control (IDOR)	High7.1	—	0.3%	3 days ago
35Monitor	CVE-2026-121417No exploit	SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backendssurrealdb · surrealdb · CWE-416 Memory safety	High8.8	—	0.2%	3 days ago
34Monitor	CVE-2026-121419No exploit	SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collisionsurrealdb · surrealdb · CWE-269 Auth bypass	High8.6	—	0.3%	3 days ago
28Monitor	CVE-2026-121423No exploit	SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serializationsurrealdb · surrealdb · CWE-674 Denial of service	High7.1	—	0.3%	3 days ago
33Monitor	CVE-2026-121424No exploit	Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Commentsnodemailer · nodemailer · CWE-20 Pre-auth	High8.3	—	0.3%	3 days ago
33Monitor	CVE-2026-121425No exploit	Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsingnodemailer · nodemailer · CWE-20 Pre-auth	High8.3	—	0.3%	3 days ago
33Monitor	CVE-2026-121426No exploit	Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparsernodemailer · nodemailer · CWE-20 Pre-auth	High8.3	—	0.2%	3 days ago
34Monitor	CVE-2026-121427No exploit	AzuraCast through 0.23.8 Config Injection via frontend_config.custom_configazuracast · azuracast · CWE-15 Pre-auth	High8.7	—	0.3%	3 days ago
34Monitor	CVE-2026-121428No exploit	AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezoneazuracast · azuracast · CWE-94 RCE	High8.7	—	0.7%	3 days ago
34Monitor	CVE-2026-121429No exploit	AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()azuracast · azuracast · CWE-78 RCE Command injection	High8.7	—	1.4%	3 days ago
34Monitor	CVE-2026-121436No exploit	Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpfroxlor · froxlor · CWE-200 Info leak	High8.6	—	0.4%	3 days ago
34Monitor	CVE-2026-121437No exploit	Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiterslepture · mistune · CWE-407 Pre-auth	High8.7	—	0.6%	3 days ago
34Monitor	CVE-2026-121444No exploit	svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graphdarylldoyle · svg-sanitizer · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	3 days ago
32Monitor	CVE-2026-121445No exploit	svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Strippingdarylldoyle · svg-sanitizer · CWE-754 Pre-auth	High8.2	—	0.3%	3 days ago
34Monitor	CVE-2026-121448No exploit	Dockhand before 1.0.54 Path Traversal via Stack Environment Routesfinsys · dockhand · CWE-22 Path traversal	High8.7	—	0.4%	3 days ago
28Monitor	CVE-2026-121449No exploit	Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhookfinsys · dockhand · CWE-200 Info leak	High7.1	—	0.4%	3 days ago
29Monitor	CVE-2026-121506No exploit	Out-of-bounds Write in NTPsecntpsec · ntpsec · CWE-787 Pre-auth Memory safety	High7.4	—	0.4%	3 days ago
30Monitor	CVE-2026-121510No exploit	Out-of-bounds Write in µD3TNd3tn gmbh · µd3tn · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	3 days ago
28Monitor	CVE-2026-121511No exploit	Out-of-bounds Read in µD3TNd3tn gmbh · µd3tn · CWE-125 Memory safety	High7.1	—	0.1%	3 days ago
30Monitor	CVE-2026-121512No exploit	Missing Release of Memory after Effective Lifetime in µD3TNd3tn gmbh · µd3tn · CWE-401 Pre-auth Denial of service	High7.5	—	0.4%	3 days ago
30Monitor	CVE-2026-121513No exploit	Out-of-bounds Write in µD3TNd3tn gmbh · µd3tn · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	3 days ago
30Monitor	CVE-2026-118487No exploit	Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParsereclipse foundation · eclipse vert.x · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	3 days ago
30Monitor	CVE-2026-119215No exploit	AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountteam-alembic · ash_authentication · CWE-639 Broken access control (IDOR)	High7.6	—	0.5%	3 days ago
34Monitor	CVE-2026-119741No exploit	rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisionssamba · rsync · CWE-407 Pre-auth	High8.7	—	0.6%	3 days ago
34Monitor	CVE-2026-121260No exploit	Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injectionziroom · zhome a0101 · CWE-74 RCE	High8.5	—	0.8%	3 days ago
30Monitor	CVE-2026-121450No exploit	CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUIDpaicni · cfnext · CWE-760	High7.7	—	0.2%	3 days ago
34Monitor	CVE-2026-121451No exploit	AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFamir1376 · ab-download-manager · CWE-352 Pre-auth CSRF	High8.7	—	0.2%	3 days ago
33Monitor	CVE-2026-121452No exploit	bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Servicemlogclub · bbs-go · CWE-295 Pre-auth Weak crypto	High8.3	—	0.2%	3 days ago
34Monitor	CVE-2026-121543No exploit	smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalationa466350665 · smart-sso · CWE-863 Broken access control (IDOR)	High8.7	—	0.4%	3 days ago
33Monitor	CVE-2026-121548No exploit	nnn through 5.3 OS Command Injection via togglex Pluginjarun · nnn · CWE-78 RCE Command injection	High8.4	—	1.1%	3 days ago
32Monitor	CVE-2026-121554No exploit	cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirectssilkimen · cordova-plugin-advanced-http · CWE-201 Pre-auth	High8.2	—	0.4%	3 days ago
34Monitor	CVE-2026-121555No exploit	Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbdrizzletime · foxel · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	3 days ago
34Monitor	CVE-2026-121556No exploit	FastBee through 2.1.0 IDOR via /iot/product By-ID Endpointsbeecue · fastbee · CWE-639 Broken access control (IDOR)	High8.7	—	0.4%	3 days ago
32Monitor	CVE-2026-121557No exploit	WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootwppconnect · wppconnect-server · CWE-306 Pre-auth Auth bypass	High8.2	—	0.4%	3 days ago
34Monitor	CVE-2026-121559No exploit	GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloningglpi-project · glpi · CWE-269	High8.6	—	0.4%	3 days ago
28Monitor	CVE-2026-121560No exploit	LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/postslogchimp · logchimp · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	3 days ago
28Monitor	CVE-2026-65168No exploit	NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.nvidia · slurm · CWE-122 Memory safety	High7.0	—	0.1%	3 days ago
34Monitor	CVE-2026-73328No exploit	Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/volmarg · personal-management-system · CWE-434 RCE File upload	High8.6	—	0.7%	3 days ago
33Monitor	CVE-2026-103916No exploit	Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directorydocker · docker sandboxes · CWE-59	High8.4	—	0.2%	3 days ago
36Monitor	CVE-2026-109593No exploit	An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potesonicwall · global management system (gms) · CWE-636 Pre-auth	Critical9.1	—	0.5%	3 days ago
30Monitor	CVE-2026-115290Proof of concept	Uncontrolled Recursion in Elasticsearch Leading to Denial of Serviceelastic · elasticsearch · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	3 days ago
29Monitor	CVE-2026-115294No exploit	Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletionelastic · kibana · CWE-22 Path traversal	High7.3	—	0.3%	3 days ago
29Monitor	CVE-2026-115714No exploit	Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connectionselastic · elastic docker images · CWE-295 Pre-auth Weak crypto	High7.4	—	0.1%	3 days ago
21Monitor	CVE-2026-119495Proof of concept	WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerabilitywebberzone · better search · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.5%	3 days ago
34Monitor	CVE-2026-121602No exploit	Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOINsolanum-ircd · solanum · CWE-122 RCE Memory safety	High8.5	—	0.8%	3 days ago
34Monitor	CVE-2026-121603No exploit	Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handlersolanum-ircd · solanum · CWE-120 RCE Memory safety	High8.5	—	0.7%	3 days ago

CVE-2026-77799
29Monitor
Two-factor authentication bypass
HighCVSS 7.4No exploitEPSS 1%
- Pre-auth
- Auth bypass
zohocorp · manageengine key manager plus3 days ago
CVE-2026-77800
30Monitor
Authentication bypass vulnerability
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
zohocorp · manageengine key manager plus3 days ago
CVE-2026-120987
30Monitor
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
naver · naver whale browser3 days ago
CVE-2026-13594
36Monitor
Improper Access Control vulnerability
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
zohocorp · log3603 days ago
CVE-2026-16900
30Monitor
Authentication Bypass
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
zohocorp · log3603 days ago
CVE-2026-4052
39Monitor
Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wso2 · wso2 api manager3 days ago
CVE-2026-74846
30Monitor
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
3 days ago
CVE-2026-105978
34Monitor
Command Injection in Management Control Functions
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
welotec · tk1003 days ago
CVE-2026-105979
34Monitor
Command Injection in ZeroTier VPN
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
welotec · tk1003 days ago
CVE-2026-105980
34Monitor
Command Injection in WireGuard VPN
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
welotec · tk1003 days ago
CVE-2026-105981
34Monitor
Command Injection in Digital I/O
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
welotec · tk1003 days ago
CVE-2026-105982
34Monitor
Command Injection in IPsec VPN
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
welotec · tk1003 days ago
CVE-2026-113421
29Monitor
ThreadX Modules invokes trace-full callbacks after module unload
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
- Memory safety
eclipse foundation · eclipse threadx3 days ago
CVE-2026-115231
34Monitor
User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
eclipse foundation · eclipse threadx3 days ago
CVE-2026-121022
36Monitor
Default Administrator Password Change Not Enforced in Axxon One Web Client
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
axxonsoft · axxon one3 days ago
CVE-2026-92610
39Monitor
Improper limitation of paths in py-aspect-model-loader
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
eclipse foundation · eclipse semantic modeling framework (esmf)3 days ago
CVE-2026-119724
30Monitor
Apache JClouds: XML External Entity (XXE) in provider-response parsing
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XXE
apache software foundation · apache jclouds3 days ago
CVE-2026-120330
28Monitor
Broken Access Control in extension "Mail" (mail)
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
typo3 · extension "mail"3 days ago
CVE-2026-120333
35Monitor
Broken Access Control in extension "Frontend User Registration" (sf_register)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "frontend user registration"3 days ago
CVE-2026-77691
32Monitor
Command injection vulnerability
HighCVSS 8.1No exploitEPSS 1%
- RCE
- Command injection
zohocorp · manageengine key manager plus3 days ago
CVE-2026-77777
28Monitor
Improper access control vulnerability
HighCVSS 7.1No exploitEPSS 0%
zohocorp · manageengine key manager plus3 days ago
CVE-2026-77778
28Monitor
Improper access control vulnerability
HighCVSS 7.1No exploitEPSS 0%
zohocorp · manageengine key manager plus3 days ago
CVE-2026-89292
36Monitor
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SSRF
- Info leak
eclipse foundation · eclipse mnestix3 days ago
CVE-2026-89293
35Monitor
Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse mnestix3 days ago
GHSA-9fm9-c4h4-8g93
31Monitor
Out-of-bounds read when decoding internal keys shorter than 16 bytes
HighCVSS 7.9No exploit
3 days ago
GHSA-m9qr-4rcq-3jhc
31Monitor
Data race and double free via unsound `Send`/`Sync` in `reblessive`
HighCVSS 7.8No exploit
3 days ago
CVE-2026-99246
32Monitor
tipc: protect node reset trace dump with node lock
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linux3 days ago
CVE-2026-99269
31Monitor
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
HighCVSS 7.8No exploitEPSS 0%
linux · linux3 days ago
CVE-2026-108047
34Monitor
Inadequate authorization vulnerability in Alosuite’s user invitation functionality
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
am system · alo suite3 days ago
CVE-2026-121458
28Monitor
Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
corebunch · instatic3 days ago
CVE-2026-76124
35Monitor
BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
- Race condition
buddyboss · buddyboss app3 days ago
CVE-2026-99270
32Monitor
tcp: Fix potential UAF in reqsk_timer_handler().
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linux3 days ago
CVE-2026-119179
33Monitor
MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
mongodb · node.js driver3 days ago
CVE-2026-119742
35Monitor
Nagios XI < 2026R2 OS Command Injection via mibs.php
HighCVSS 8.6No exploitEPSS 4%
- RCE
- Command injection
nagios enterprises, llc · nagios xi3 days ago
CVE-2026-120572
35Monitor
Incorrect boundary conditions in the Layout: Block and Inline component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefox3 days ago
CVE-2026-85035
35Monitor
Use-after-free via dynamically allocated message queue retained by the CAN RX filter
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
zephyrproject · zephyr3 days ago
CVE-2026-89295
30Monitor
Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse foundation · eclipse mnestix3 days ago
CVE-2026-106991
28Monitor
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.
HighCVSS 7.1Proof of conceptEPSS 0%
3 days ago
CVE-2026-118489
30Monitor
CachingWebClient shares user-specific HTTP responses across users via the shared cache tier
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
eclipse foundation · eclipse vert.x3 days ago
CVE-2026-118527
47Plan
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload
MediumCVSS 4.3KEVWeaponizedEPSS 0%
ivanti · connect secure3 days ago
CVE-2026-121386
34Monitor
FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
freerdp · freerdp3 days ago
CVE-2026-121388
28Monitor
FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
freerdp · freerdp3 days ago
CVE-2026-121392
36Monitor
FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
freerdp · freerdp3 days ago
CVE-2026-121393
28Monitor
FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
freerdp · freerdp3 days ago
CVE-2026-121394
28Monitor
FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
freerdp · freerdp3 days ago
CVE-2026-121395
28Monitor
FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
freerdp · freerdp3 days ago
CVE-2026-121398
32Monitor
FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp3 days ago
CVE-2026-121400
28Monitor
FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
freerdp · freerdp3 days ago
CVE-2026-121402
28Monitor
FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp3 days ago
CVE-2026-121404
28Monitor
FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
freerdp · freerdp3 days ago
CVE-2026-121407
28Monitor
FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
HighCVSS 7.1No exploitEPSS 0%
freerdp · freerdp3 days ago
CVE-2026-121409
32Monitor
FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
freerdp · freerdp3 days ago
CVE-2026-121412
28Monitor
FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
freerdp · freerdp3 days ago
CVE-2026-121414
32Monitor
Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
parse-community · parse-server3 days ago
CVE-2026-121416
28Monitor
SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
surrealdb · surrealdb3 days ago
CVE-2026-121417
35Monitor
SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
surrealdb · surrealdb3 days ago
CVE-2026-121419
34Monitor
SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
surrealdb · surrealdb3 days ago
CVE-2026-121423
28Monitor
SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
surrealdb · surrealdb3 days ago
CVE-2026-121424
33Monitor
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
nodemailer · nodemailer3 days ago
CVE-2026-121425
33Monitor
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
nodemailer · nodemailer3 days ago
CVE-2026-121426
33Monitor
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
nodemailer · nodemailer3 days ago
CVE-2026-121427
34Monitor
AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
azuracast · azuracast3 days ago
CVE-2026-121428
34Monitor
AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
HighCVSS 8.7No exploitEPSS 0%
- RCE
azuracast · azuracast3 days ago
CVE-2026-121429
34Monitor
AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Command injection
azuracast · azuracast3 days ago
CVE-2026-121436
34Monitor
Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
HighCVSS 8.6No exploitEPSS 0%
- Info leak
froxlor · froxlor3 days ago
CVE-2026-121437
34Monitor
Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
lepture · mistune3 days ago
CVE-2026-121444
34Monitor
svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
darylldoyle · svg-sanitizer3 days ago
CVE-2026-121445
32Monitor
svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
darylldoyle · svg-sanitizer3 days ago
CVE-2026-121448
34Monitor
Dockhand before 1.0.54 Path Traversal via Stack Environment Routes
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
finsys · dockhand3 days ago
CVE-2026-121449
28Monitor
Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook
HighCVSS 7.1No exploitEPSS 0%
- Info leak
finsys · dockhand3 days ago
CVE-2026-121506
29Monitor
Out-of-bounds Write in NTPsec
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Memory safety
ntpsec · ntpsec3 days ago
CVE-2026-121510
30Monitor
Out-of-bounds Write in µD3TN
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
d3tn gmbh · µd3tn3 days ago
CVE-2026-121511
28Monitor
Out-of-bounds Read in µD3TN
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
d3tn gmbh · µd3tn3 days ago
CVE-2026-121512
30Monitor
Missing Release of Memory after Effective Lifetime in µD3TN
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
d3tn gmbh · µd3tn3 days ago
CVE-2026-121513
30Monitor
Out-of-bounds Write in µD3TN
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
d3tn gmbh · µd3tn3 days ago
CVE-2026-118487
30Monitor
Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse foundation · eclipse vert.x3 days ago
CVE-2026-119215
30Monitor
AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
team-alembic · ash_authentication3 days ago
CVE-2026-119741
34Monitor
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
samba · rsync3 days ago
CVE-2026-121260
34Monitor
Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection
HighCVSS 8.5No exploitEPSS 0%
- RCE
ziroom · zhome a01013 days ago
CVE-2026-121450
30Monitor
CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID
HighCVSS 7.7No exploitEPSS 0%
paicni · cfnext3 days ago
CVE-2026-121451
34Monitor
AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- CSRF
amir1376 · ab-download-manager3 days ago
CVE-2026-121452
33Monitor
bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
mlogclub · bbs-go3 days ago
CVE-2026-121543
34Monitor
smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
a466350665 · smart-sso3 days ago
CVE-2026-121548
33Monitor
nnn through 5.3 OS Command Injection via togglex Plugin
HighCVSS 8.4No exploitEPSS 1%
- RCE
- Command injection
jarun · nnn3 days ago
CVE-2026-121554
32Monitor
cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
silkimen · cordova-plugin-advanced-http3 days ago
CVE-2026-121555
34Monitor
Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
drizzletime · foxel3 days ago
CVE-2026-121556
34Monitor
FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
beecue · fastbee3 days ago
CVE-2026-121557
32Monitor
WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
wppconnect · wppconnect-server3 days ago
CVE-2026-121559
34Monitor
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
HighCVSS 8.6No exploitEPSS 0%
glpi-project · glpi3 days ago
CVE-2026-121560
28Monitor
LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
logchimp · logchimp3 days ago
CVE-2026-65168
28Monitor
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
HighCVSS 7.0No exploitEPSS 0%
- Memory safety
nvidia · slurm3 days ago
CVE-2026-73328
34Monitor
Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
HighCVSS 8.6No exploitEPSS 0%
- RCE
- File upload
volmarg · personal-management-system3 days ago
CVE-2026-103916
33Monitor
Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory
HighCVSS 8.4No exploitEPSS 0%
docker · docker sandboxes3 days ago
CVE-2026-109593
36Monitor
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, pote
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
sonicwall · global management system (gms)3 days ago
CVE-2026-115290
30Monitor
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
elastic · elasticsearch3 days ago
CVE-2026-115294
29Monitor
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
elastic · kibana3 days ago
CVE-2026-115714
29Monitor
Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
elastic · elastic docker images3 days ago
CVE-2026-119495
21Monitor
WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
webberzone · better search3 days ago
CVE-2026-121602
34Monitor
Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Memory safety
solanum-ircd · solanum3 days ago
CVE-2026-121603
34Monitor
Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Memory safety
solanum-ircd · solanum3 days ago