The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Microsoft Patch Tuesday November 2027

Published: 2026-11-10

Last Updated: 2026-11-10 19:09:32 UTC

by Johannes Ullrich (Version: 1)

Microsoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Microsoft Edge.

One of the vulnerabilities, CVE-2026-124194, a spoofing vulnerability in Outlook, is already being exploited.

Other vulnerabilities of note:

CVE-2026-119958: A critical RCE vulnerability in Microsoft LDAP.

CVE-2026-109459, CVE-2026-119967, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964: Several critical vulnerabilities in Microsoft Queuing and Queue Manager.

CVE-2026-113859: Windows TCP/IP Remote Code Execution Vulnerability. CVSS score is only 7.5 ...

Read the full entry: https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+November+2027/33508/

Apple Patches Everything: November 2026 Edition

Published: 2026-11-10

Last Updated: 2026-11-10 12:48:55 UTC

by Johannes Ullrich (Version: 1)

On Monday, Apple released updates for iOS/iPadOS, macOS, watchOS, and visionOS. These updates fix nine different vulnerabilities. One of the vulnerabilities, CVE-2026-113971, applies only to iOS/iPadOS version 26. Several of the vulnerabilities apply to Bluetooth issues that may weaken the device pairing process.

The number of vulnerabilities Apple patches remains small, but Apple has increased the cadence of its updates.

Read the full entry: https://isc.sans.edu/diary/Apple+Patches+Everyting+November+2026+Edition/33506/

Scans for Sshole Vulnerability (CVE-2026-123158)

Published: 2026-11-08

Last Updated: 2026-11-08 15:44:33 UTC

by Johannes Ullrich (Version: 1)

Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.

Our data starts showing the increase of the use of long passwords on November 1st. Since then, the number of requests has been increasing ...

Read the full entry: https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498/

Attackers Searching for SAP Netweaver Webshells (2026.11.09)

https://isc.sans.edu/diary/Attackers+Searching+for+SAP+Netweaver+Webshells/33502/

Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers (2026.11.05)

https://isc.sans.edu/diary/Vulnerability+Scans+for+Older+Cisco+IOS+Vulnerability+OptOut+Headers/33492/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-123158 - OpenSSH before 10.6p2 on Linux using musl libc without PAM is vulnerable to a password authentication bypass, allowing arbitrary passwords of 256 to 1024 characters to succeed due to misinterpretation of password hashes.

Product: OpenSSH

CVSS Score: 8.1

** KEV since 2026-11-09 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123158

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158

ISC Diary: https://isc.sans.edu/diary.html?storyid=33498

ISC Podcast: https://isc.sans.edu/podcastdetail/10168

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-123158

NVD References: https://sshole.events.greynoise.io/

CVE-2015-5477 - ISC BIND Data Processing Errors Vulnerability

Product: ISC BIND

CVSS Score: 0

** KEV since 2026-10-08 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2015-5477

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477

CVE-2025-31324 - SAP NetWeaver Visual Composer Metadata Uploader lacks proper authorization, enabling unauthenticated agents to upload harmful executables, compromising system security.

Product: SAP NetWeaver Visual Composer

CVSS Score: 0

** KEV since 2025-04-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-31324

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324

ISC Diary: https://isc.sans.edu/diary/33502

ISC Podcast: https://isc.sans.edu/podcastdetail/10172

CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability

Product: Microsoft Office Outlook

CVSS Score: 6.5

** KEV since 2026-11-10 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124194

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194

ISC Diary: https://isc.sans.edu/diary/33508

ISC Podcast: https://isc.sans.edu/podcastdetail/10174

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

CVE-2026-125350 - Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Product: Google Chromium CVSS Score: ** KEV since 2026-11-10 ** NVD: https://nvd.nist.gov/vuln/detail/cve-2026-125350

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350 NVD References: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

CVE-2026-111497 - Google Brotli Unchecked Return Value Vulnerability

Product: Brotli

CVSS Score: 0

** KEV since 2026-10-27 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497

CVE-2026-116779 - SignalWire FreeSwitch Code Injection Vulnerability

Product: SignalWire FreeSwitch

CVSS Score: 9.8

** KEV since 2026-11-09 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116779

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116779

NVD References: https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p

CVE-2026-109618 - PHP Memory Corruption Vulnerability

Product: PHP

CVSS Score: 0

** KEV since 2026-10-26 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109618

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618

CVE-2026-109619 - PHP Stale Internal Request-State Vulnerability

Product: PHP

CVSS Score: 0

** KEV since 2026-10-26 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109619

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619

CVE-2026-102895 - GPUStack Improper Authentication Vulnerability

Product: GPUStack

CVSS Score: 9.8

** KEV since 2026-11-09 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102895

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102895

NVD References: https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr

CVE-2026-118527 - Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Product: Ivanti Connect Secure

CVSS Score: 4.3

** KEV since 2026-10-30 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118527

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527

NVD References: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

CVE-2024-27834 - Apple Multiple Products Improper Authentication Vulnerability

Product: Multiple Apple Products

CVSS Score: 0

** KEV since 2026-11-04 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27834

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27834

CVE-2026-119977 - WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Product: WordPress Core

CVSS Score: 0

** KEV since 2026-11-03 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119977

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977

CVE-2026-123218 - IBM Aspera Faspex Incorrect Authorization Vulnerability

Product: IBM Aspera Faspex

CVSS Score: 0

** KEV since 2026-11-09 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123218

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123218

CVE-2026-19868 - SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

Product: SonicWall SonicOS SSLVPN

CVSS Score: 0

** KEV since 2026-11-06 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19868

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

ISC Podcast: https://isc.sans.edu/podcastdetail/10170

CVE-2026-109593 - SonicWall GMS 9.5.2 and earlier versions may allow unauthenticated attackers with network access to read internal files, potentially exposing sensitive information.

Product: SonicWall GMS

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109593

ISC Podcast: https://isc.sans.edu/podcastdetail/10166

NVD References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

CVE-2026-28336 - SolarWinds Dameware is susceptible to a command injection vulnerability, requiring authentication, which could compromise the remotely controlled host.

Product: SolarWinds Dameware

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28336

NVD References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

CVE-2026-89103 - SAP Gateway activates a default Access Control List with high privileges, enabling unauthenticated external attackers to impersonate internal application servers and potentially perform unauthorized actions, compromising the system's confidentiality, integrity, and availability.

Product: SAP Gateway

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89103

ISC Podcast: https://isc.sans.edu/podcastdetail/10174

CVE-2026-76964 - SAP NetWeaver Application Server ABAP is vulnerable to memory corruption due to insufficient validation of network input, potentially allowing unauthenticated attackers to execute arbitrary code and fully compromise the system.

Product: SAP NetWeaver Application Server ABAP

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76964

ISC Podcast: https://isc.sans.edu/podcastdetail/10174

CVE-2026-89126 - SAP Web Dispatcher fails to adequately validate network input, allowing unauthenticated attackers to send crafted traffic that could cause memory corruption and enable arbitrary code execution, compromising the system's confidentiality, integrity, and availability.

Product: SAP Web Dispatcher

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89126

ISC Podcast: https://isc.sans.edu/podcastdetail/10174

Multiple Vulnerabilities in Chromium

(Buffer overflow, Confused deputy, Improper adherence to coding standards, Improper input validation, Improper resource exposure, Improper state validation, Inadequate encryption strength, Incomplete cleanup, Incorrect authorization, Incorrect reference resolution, Information leak, Information loss, Integer overflow, Memory corruption, Missing authorization, Observable discrepancy, Out of bounds read, Out of bounds write, Privilege elevation, Race condition, Type confusion, UI misrepresentation, Uncontrolled recursion, Uninitialized resource, Use after free, Use of released resource)

CVSS Scores: 4.3 - 9.8

ISC Diary: https://isc.sans.edu/diary/33508

NVD References:

- https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

CVE-2026-113859 - Windows TCP/IP Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113859

ISC Diary: https://isc.sans.edu/diary/33508

ISC Podcast: https://isc.sans.edu/podcastdetail/10174

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113859

CVE-2026-119958 - Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Product: Microsoft Windows LDAP

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119958

ISC Diary: https://isc.sans.edu/diary/33508

ISC Podcast: https://isc.sans.edu/podcastdetail/10174

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119958

CVE-2026-109459, CVE-2026-116710, CVE-2026-119963, VE-2026-119964, CVE-2026-119967 - Windows Message Queuing Queue Manager Remote Code Execution Vulnerabilities

Product: Microsoft Windows Message Queuing

CVSS Score: 8.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109459

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116710

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119963

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119964

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119967

ISC Diary: https://isc.sans.edu/diary/33508

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109459

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116710

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119963

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119964

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119967

CVE-2026-109469 - Entra Device Registration Elevation of Privilege Vulnerability

Product: Microsoft Entra Device Registration

CVSS Score: 10.0

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109469

ISC Diary: https://isc.sans.edu/diary/33508

ISC Podcast: https://isc.sans.edu/podcastdetail/10170

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469

CVE-2026-109518 - Debian, Ubuntu, and derivative Linux distributions are vulnerable to an on-path attack that can manipulate HTTP traffic during package installation, allowing an attacker to trick the APT client into installing a malicious package with root privileges through the reuse of hard links and client redirection settings.

Product: Debian, Ubuntu, and derivative Linux distributions

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109518

ISC Podcast: https://isc.sans.edu/podcastdetail/10166

NVD References:

- https://lists.debian.org/debian-security-announce/2026/msg00526.html

- https://ubuntu.com/security/notices/USN-8996-1

- https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html

CVE-2026-107441 - Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 have an out-of-bounds write vulnerability in the CGI program that could allow an unauthenticated adjacent attacker to execute OS commands via a crafted HTTP request.

Product: Zyxel GS1900-24E

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107441

ISC Podcast: https://isc.sans.edu/podcastdetail/10168

NVD References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

CVE-2026-58115 - SIMATIC IoT2050 devices with Node-RED installed prior to version 4.3.4-1 lack authentication on the HTTP interface, enabling unauthenticated remote attackers to create malicious flows that execute arbitrary code on the server.

Product: Siemens SIMATIC IoT2050

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58115

ISC Podcast: https://isc.sans.edu/podcastdetail/10164

CVE-2026-120640 - CGI versions prior to 5.00 for Perl allow attackers to manipulate POSTDATA, PUTDATA, PATCHDATA, and XForms:Model parameters via query strings or form fields.

Product: CGI

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120640

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120640

CVE-2026-120641 - CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

Product: CGI

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120641

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120641

CVE-2026-120637 - CGI versions before 5.00 for Perl are vulnerable to unauthorized exposure of command line arguments when processing unrecognized REQUEST_METHODs, such as OPTIONS, due to fallback to a debug mode that is enabled by default.

Product: CGI

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120637

CVE-2026-13594 - ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to unauthorized access by adversaries.

Product: Zoho Corporation ManageEngine Log360 and EventLog Analyzer

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13594

NVD References: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html

CVE-2026-38600 - Codeskyblue gohttpserver v1.3.0 contains a Zip Slip vulnerability in the /upload endpoint that allows attackers to write arbitrary files by uploading a specially crafted Zip archive.

Product: Codeskyblue gohttpserver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-38600

CVE-2026-44266 - Elo is vulnerable to Ruby code and shell command execution due to insecure embedding of attacker-controlled text in double-quoted strings prior to version 1.0.1.

Product: Elo

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44266

NVD References: https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542

CVE-2026-44267 - Elo before version 1.0.1 is vulnerable to code injection via plain strings, allowing attackers to execute arbitrary JavaScript in the host environment due to improper handling of meta-properties, leading to potential session compromise and arbitrary code execution.

Product: Elo

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44267

NVD References: https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5

Multiple vulnerabilities in HPE Networking Fabric Composer

Product: HPE Networking Fabric Composer

CVSS Scores: 9.6 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95731 (hardcoded password)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95732 (authentication bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95733 (arbitrary code executution)

NVD References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US

CVE-2026-112354 - Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 has a hard-coded default credentials vulnerability that enables remote attackers to gain full Administrator access and unauthorized control over the charging station via cleartext HTTP.

Product: Etrel INCH AC charging station

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112354

NVD References: https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials

CVE-2026-122006 - The activestorage gem before 8.1.4.1 for Ruby on Rails is vulnerable to unauthorized read and write operations due to a lack of proper ImageMagick security policies during attachment processing.

Product: Ruby on Rails activestorage

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122006

NVD References:

- https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9

- https://github.com/rubysec/ruby-advisory-db/pull/1300

CVE-2026-121952 - FreeRDP before 3.32.2 contains an out-of-bounds write vulnerability in the proxy due to improper handling of bitmap cache v2 cell array indices, allowing a client to cause heap corruption or crashes.

Product: FreeRDP

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-121952

NVD References: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xc85-4mqc-xgcx

CVE-2026-121953 - FreeRDP before 3.32.2 contains a use-after-free vulnerability in the rdpgfx dynamic virtual channel that allows a malicious RDP server to crash the client or potentially execute code by manipulating duplicate-name channels.

Product: FreeRDP

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-121953

NVD References: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp

CVE-2026-122120 - Yealink Plug-in Softwares before 2.35.219.0 contain an unauthorized file write vulnerability that could allow attackers to achieve remote code execution under specific conditions.

Product: Yealink Plug-in Softwares

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122120

NVD References: https://www.yealink.com/en/trust-center/security-bulletins/yealink-plugin-softwares-remote-code-execution-vulnerability

Multiple vulnerabilities in Apache OFBiz

Product: Apache OFBiz

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74841 (denial-of-service)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81815 (SQL Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82907 (authentication bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83542 (code injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105330 (hard-coded cryptographic key)

NVD References: https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

CVE-2026-54141 - OpenHuman is vulnerable to a flaw that allows external senders to execute JavaScript and operating-system commands as the OpenHuman user without approval, due to improper handling of remote direct messages through a configured Yuanbao channel before version 0.57.13.

Product: OpenHuman

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54141

NVD References: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-gg3m-wgmq-vhmx

CVE-2026-54143 - OpenHuman, prior to version 0.57.13, is vulnerable to an attacker sending messages to a configured external channel, allowing the creation of persistent shell cron jobs without human approval, which can lead to unauthorized command execution and compromise of system resources.

Product: OpenHuman

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54143

NVD References: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-f46p-6vf9-64mm

CVE-2026-116785 - FreeSWITCH, prior to version 1.11.2, contains a vulnerability in the ws_read_frame() function that allows a heap overwrite due to incorrect handling of WebSocket frame lengths, potentially leading to crashed connections while remote code execution has not yet been demonstrated.

Product: Freeswitch

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116785

NVD References: https://github.com/signalwire/freeswitch/security/advisories/GHSA-jj89-q47c-gh94

CVE-2026-48705 - MONAI prior to version 1.6.1 is vulnerable to an unauthenticated attacker uploading crafted DICOM files that can propagate non-finite values, potentially leading to inference failures or corrupted results.

Product: MONAI

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48705

NVD References: https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-6hp3-vr39-rqw8

CVE-2026-119757 - BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, contain an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND node, potentially enabling theft of funds.

Product: BTCPay Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119757

CVE-2026-4052 - WSO2 Identity Server may allow self-registered users to access WSO2 API Manager's System REST APIs by obtaining a token from its token endpoint when configured as a Resident Key Manager with database sharing.

Product: WSO2 Identity Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-4052

NVD References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/

CVE-2026-92610 - ESMF-SDK-PY-ASPECT-MODEL-LOADER versions 2.1.2 to 2.2.1 allows for directory traversal through improperly resolved URN namespaces, enabling the loader to glob and parse Turtle files from arbitrary locations outside the intended model's root.

Product: ESMF-SDK-PY-ASPECT-MODEL-LOADER

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92610

CVE-2026-82158 - Dell Wyse Management Suite, versions prior to 2609.0.0.155, has a Cross-site Scripting vulnerability that could allow a low-privileged remote attacker to inject scripts.

Product: Dell Wyse Management Suite

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82158

NVD References: https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities

CVE-2022-29966 - Emerson Ovation has multiple unauthenticated protocols that could enable an attacker to alter controller configurations or trigger a denial-of-service condition.

Product: Emerson Ovation

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-29966

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02

CVE-2026-39430 - HP Poly EagleEye Cube USB 1.3.1-001267 devices are vulnerable to unauthorized administrative access due to broken session management and access controls, allowing unauthenticated users to modify settings and retrieve sensitive credentials through a modified client.

Product: HP Poly EagleEye Cube

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-39430

CVE-2026-113780 - ESF-IDF versions 5.5.5 through 5.5.6, 6.0.4, and 6.1.1 contain a vulnerability that allows local unprivileged REE applications to exploit a flaw in the esp_tee_vectors_plic.S and esp_tee_vectors_clic.S files, enabling unauthorized access to TEE-exclusive memory and potentially compromising system integrity on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices.

Product: ESF-IDF

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113780

NVD References: https://github.com/espressif/esp-idf/security/advisories/GHSA-49x8-xqjg-2pjg

CVE-2025-71457 - Vtenext 25.02 before 25.02.1 has an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification.

Product: Vtenext

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-71457

NVD References: https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php

CVE-2026-82418 - IBM Watson Speech Services Cartridge versions 4.0.0 to 5.4.0 contain a use-after-free vulnerability that could allow remote attackers to execute arbitrary code.

Product: IBM Watson Speech Services Cartridge

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82418

NVD References: https://www.ibm.com/support/pages/node/7293510

CVE-2026-102894 - GPUStack, versions 0.7.1 to 2.2.2, is vulnerable to SAML XML decoding flaws that allow attackers to impersonate users or provision accounts without proper verification of signatures or session integrity, including replaying signed responses.

Product: GPUStack

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102894

NVD References: https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6

CVE-2026-115770 - Pocket ID versions 2.2.0 to 2.12.0 are vulnerable to an email verification token flaw that allows users to exploit the authentication process to associate an arbitrary unused email address with their account, which can lead to unauthorized account access if a relying application incorrectly trusts the verified email.

Product: Pocket ID

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-115770

NVD References: https://github.com/pocket-id/pocket-id/security/advisories/GHSA-rm8c-2cv8-jwf6

Multiple vulnerabilities in Kyverno

CVSS Scores: 9.8 - 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122302 (privilege escalation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122303 (authorization bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122304 (authorization bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122311 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122313 (privilege escalation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-122321 (signature verification bypass)

NVD References:

- https://github.com/kyverno/kyverno/security/advisories/GHSA-q62c-r9v2-cf64

- https://github.com/kyverno/kyverno/security/advisories/GHSA-jcw5-3wcg-fqx5

- https://github.com/kyverno/kyverno/security/advisories/GHSA-p58h-r4j3-h5vx

- https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4

- https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2

- https://github.com/kyverno/kyverno/security/advisories/GHSA-f96w-622v-rqpq

- https://github.com/kyverno/kyverno/security/advisories/GHSA-2r43-6962-xcw5

CVE-2026-117691 - Keycloak has a vulnerability in its SAML HTTP-Redirect binding implementation that allows attackers to exploit discrepancies between percent-encoded and literal parameter names to bypass signature verification, potentially leading to full account takeover of federated users.

Product: Keycloak

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-117691

CVE-2026-100358 - SuiteCRM allows an attacker to inject persistent PHP code via the Studio Dropdown Editor, compromising application and host security, prior to versions 7.15.2 and 8.10.2.

Product: SuiteCRM

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100358

NVD References: https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4773-c8fh-3rww

CVE-2026-71550 - SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a path traversal attack in the workflow controller, allowing authenticated users with the WorkFlow role to execute arbitrary PHP code and access sensitive CRM data.

Product: SuiteCRM

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71550

NVD References: https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-cx24-rr7r-mxrg

CVE-2026-102940 - OpenEMR prior to version 8.4.0 contains a vulnerability allowing low-privilege authenticated users to reassign documents to different patients or categories without proper access verification, leading to unauthorized data access.

Product: OpenEMR

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102940

NVD References: https://github.com/openemr/openemr/security/advisories/GHSA-92rh-g949-4mvv

CVE-2026-116790 - FreeSWITCH prior to version 1.11.2 lacks cryptographic validation for STUN MESSAGE-INTEGRITY in ICE handling, allowing attackers to forge connectivity checks, redirect RTP and DTLS traffic, and potentially eavesdrop or inject media on unencrypted connections.

Product: FreeSWITCH

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116790

NVD References: https://github.com/signalwire/freeswitch/security/advisories/GHSA-rc25-33hp-6mv2

CVE-2026-112902 - Pillow versions through 12.3.0 are vulnerable to memory disclosure and crashes due to improper handling of attacker-controlled TIFF metadata in the libtiff TIFF encoder, which is fixed in version 13.0.0.

Product: Python Pillow

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112902

NVD References: https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v

CVE-2026-77596 - Kubeflow Pipelines prior to version 2.18.0 contains a vulnerability that allows low-privilege tenants to create or inject pipelines across namespaces without proper permissions if the API server is directly reachable, potentially leading to unauthorized access or execution of malicious workloads.

Product: Kubeflow Pipelines

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77596

NVD References: https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g

CVE-2026-63017 - Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Product: PowerSYSTEM Center

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63017

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01

CVE-2026-63774 - Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Product: PowerSYSTEM Center

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63774

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01

CVE-2026-83493 - A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.

Product: Red Hat OpenShift AI

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83493

NVD References: https://access.redhat.com/security/cve/CVE-2026-83493

CVE-2026-123279 - In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

Product: JetBrains Datalore

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123279

NVD References: https://www.jetbrains.com/privacy-security/issues-fixed/

CVE-2026-123294 - In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Product: JetBrains Hub

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123294

NVD References: https://www.jetbrains.com/privacy-security/issues-fixed/

CVE-2026-57566 - Readest version prior to 0.11.10 contains a vulnerability in its unauthenticated /api/opds/proxy route that allows remote attackers to exploit it as an open request proxy, potentially retrieving internal network data and cloud metadata by bypassing scheme restrictions and reflecting upstream responses.

Product: Readest

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57566

NVD References: https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx

CVE-2026-97693 - Yuxi is vulnerable to cross-tenant data exposure and potential denial of service due to insufficient isolation between Docker sandboxes and trusted services, allowing low-privileged authenticated users to access others' APIs, files, and secrets, with the issue resolved in version 0.7.1, but requiring manual credential rotation for existing deployments.

Product: Yuxi

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97693

NVD References: https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445