CVEs published in November 2026
7,997 vulnerabilities, 689 critical, 12 exploited.
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession7.4 High
- pymodaq, pymodaq data, gui +1 more +3 morePyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files8.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing7.5 High
- immich-app immichImmich calendar heatmap endpoint discloses cross-user activity through broken access control4.3 Medium
- h5ioh5io before 0.2.6 Arbitrary Code Execution via read_hdf58.5 High
- esa asn1sccASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()8.1 High
- esa asn1sccASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders5.3 Medium
- esa asn1sccASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)8.1 High
- tinyhumansai openhumanOpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth7.7 High
- tinyhumansai openhumanOpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval8.7 High
- tinyhumansai openhumanOpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)8.8 High
- tinyhumansai openhumanOpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution9.8 Critical
- tinyhumansai openhumanOpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`9.0 Critical
- aws gluontsGluonTS arbitrary file write during archive extraction8.4 High
- tinyhumansai openhumanOpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token8.4 High
- tinyhumansai openhumanOpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)8.8 High
- tinyhumansai openhumanOpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data6.2 Medium
- red hat hardened imagesDnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction6.6 Medium
- adobe photoshopRejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim...8.8 High
- adobe illustrator ccRejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim...7.8 High
- tinyhumansai openhumanOpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture6.1 Medium
- tinyhumansai openhumanOpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization8.3 High
- francescopace espectreESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch8.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length8.2 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length8.8 High
- ntop ntopngntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access8.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login8.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop7.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path7.5 High
- ntop ntopngntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)8.8 High
- sysadminsmedia homeboxHomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service6.5 Medium
- sysadminsmedia homeboxHomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields5.4 Medium
- sysadminsmedia homeboxHomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay3.7 Low
- ultravioletrs cocosCocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks9.1 Critical
- sensiolabs symfonySymfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass6.3 Medium
- ultravioletrs cocosCocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks7.2 High
- openbsd opensshsshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...8.1 High
- keywordrush content egg – affiliate product importer & price comparisonContent Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks6.9 Medium
- heyformHeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS7.6 High
- leejet stable-diffusion.cppstable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file6.9 Medium
- leejet stable-diffusion.cppstable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name7.8 High
- trellix dlp on-prem extensionsServer side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1...5.3 Medium
- rapid7 metasploit frameworkRapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication7.3 High
- Show moreLoading…