Section
Advisories
Vendor PSIRT bulletins, CERT notes, CISA and partner-agency alerts, and distribution security notices.
1,053 matching records, 3 with confirmed exploitation.
-
November 2026 Patch Tuesday
What's happened since October Patch Tuesday The weeks leading up to November Patch Tuesday gave defenders three clear tests of how fast they can move. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was exploited before PHP…
-
Siemens RUGGEDCOM APE1808
Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised…
-
Siemens RUGGEDCOM APE1808
Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised…
-
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire…
-
Siemens Desigo, Gridscale
On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The…
-
CISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference…
-
Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
On 12 November 2026, the Cloud Software Group published security bulletins for its Citrix products addressing 28 memory flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway. One of these vulnerabilities, CVE-2026-120868…
-
Siemens Building Automation and Energy Products
On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and…
-
Siemens Industrial Edge Management
Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the…
-
Linux kernel (FIPS) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Hardware monitoring…
-
Linux kernel (NVIDIA Tegra) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
Apache HTTP Server vulnerabilities
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache…
-
Critical: Red Hat Single Sign-On 7.6.14 security update
A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS)…
-
Linux kernel (HWE) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file systems library; - Stream parser…
-
Authentication bypass by primary weakness
CVSSv3 Score: 9.3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially crafted request Revised on…
-
Incorrect authorization
CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiAuthenticator may allow an attacker to bypass authentication and gain unauthorized access. Revised on 2026-11-10 00:00:00
-
Authorization bypass through user-controlled key
CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.…
-
Authentication bypass
CVSSv3 Score: 9.0 A Use of Hard-coded Password [CWE-259] vulnerability in FortiAuthenticator may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and…
-
Numeric truncation error
CVSSv3 Score: 9.6 A Numeric Truncation Error vulnerability [cwe-197] in FortiOS and FortiSASE bgp daemon may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted…
-
Incorrect authorization
CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted…
-
Improper neutralization of special elements used in an os command
CVSSv3 Score: 9.8 An Improper neutralization of special elements used in a command ('command injection') [CWE-77] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA…
-
Improper limitation of a pathname to a restricted directory
CVSSv3 Score: 9.8 An Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted…
-
Improper neutralization of special elements used in an SQL command
CVSSv3 Score: 9.4 An Improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.…
-
Unbound vulnerabilities
USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding update for…
-
Windows Hyper-V Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
-
Cisco Identity Services Engine Authorization Bypass Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the…
-
TightVNC and UltraVNC Viewer contains a heap-based buffer overflow
Overview A heap-based buffer overflow exists in the Tight JPEG decoding component of the TightVNC Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers. An attacker controlling a malicious VNC server can trigger…
-
Critical: Red Hat OpenStack Platform 17.1 (openstack-manila) security update
An update for openstack-manila is now available for Red Hat OpenStack Platform 17.1 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS)…
-
Debian-LAN vulnerability
Wolfgang Schweer discovered that Debian-LAN configured overly permissive ACLs for the Kerberos admin server. An authenticated user could possibly use this issue to change the credentials of other users, leading to privilege…
-
TigerVNC vulnerability
It was discovered that the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. A remote attacker could possibly use this issue to impersonate any VNC server after a user had added a certificate…
-
Important: thunderbird security, bug fix, and enhancement update
An update for thunderbird is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability…
-
Critical: Red Hat Single Sign-On 7.6.14 security update on RHEL 7
New Red Hat Single Sign-On 7.6.14 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System (CVSS) base…
-
Critical: Red Hat Single Sign-On 7.6.14 security update on RHEL 8
New Red Hat Single Sign-On 7.6.14 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System (CVSS) base…
-
Critical: Red Hat Single Sign-On 7.6.14 security update on RHEL 9
New Red Hat Single Sign-On 7.6.14 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System (CVSS) base…
-
Important: dnsmasq security update
An update for dnsmasq is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System…
-
Critical: Red Hat Single Sign-On 7.6.14 for OpenShift image security update
A new image is available for Red Hat Single Sign-On 7.6.14, running on OpenShift Container Platform 3.10 and 3.11, and 4.3.
-
postgresql-17 - security update
Multiple security issues were discovered in PostgreSQL, which may result in execution of arbitrary code, incorrect authentication, information disclosure, denial of service or privilege escalation. To completely fix CVE-2026-6460…
-
CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
Bulletin ID: 2026-182-AWS Publication Date: 11/12/2026 13:00 PM PST Description: An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and…
-
CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
Bulletin ID: 2026-181-AWS Publication Date: 11/12/2026 13:00 PM PST Description: We identified CVE-2026-127119, an issue in the EMR module of AWS SDK for pandas (awswrangler) from version 1.1.0 before 3.18.0. When a cluster is…
-
Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists…
-
Linux kernel (HWE) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
Pillow vulnerabilities
It was discovered that Pillow could enter an infinite loop while determining the frame count of a MIC image. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu…
-
Critical: Satellite 6.17.13 Async Update
An update is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Critical: Satellite 6.16.15 Async Update
An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which…
-
FGFM elevation before registration password is verified
CVSSv3 Score: 9.0 An improper authorization vulnerability in FortiManager FGFM may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets. Revised on 2026-11-10 00:00:00
-
Authorization bypass through user-controlled key in dmserver
CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via…
-
Remote Desktop Client Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
Windows Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally.
-
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Windows Kerberos Denial of Service Vulnerability
Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.
-
Windows Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally.
-
Windows Active Directory Certificate Services Information Disclosure Vulnerability
Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network.
-
Windows Hyper-V Denial of Service Vulnerability
Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network.
-
Windows Kerberos Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.
-
Windows Hyper-V Denial of Service Vulnerability
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.
-
Windows Active Directory Certificate Services Security Feature Bypass
Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network.
-
Improper neutralization of special elements used in an SQL command
CVSSv3 Score: 8.8 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')[CWE-89] in FortiAuthenticator may allow an authenticated attacker to execute unauthorized SQL commands on the underlying…
-
Improper neutralization of special elements used in an ldap query
CVSSv3 Score: 8.2 An Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')[CWE-90] in FortiAuthenticator may allow an authenticated attacker to bypass authentication. Successful exploitation…
-
Improper privilege management
CVSSv3 Score: 7.2 An Improper Privilege Management vulnerability[CWE-269] in FortiAuthenticator may allow an authenticated attacker to escalate privileges. Revised on 2026-11-10 00:00:00
-
Allocation of resources without limits or throttling in fastapi
CVSSv3 Score: 7.5 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiAuthenticator may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of…
-
Authorization bypass through user-controlled key
CVSSv3 Score: 8.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users'…
-
Improper neutralization of special elements in output used by a downstream component in sshd
CVSSv3 Score: 7.4 A Path Traversal vulnerability [cwe-24] in FortiOS, FortiSASE, FortiProxy and FortiPam ssh daemon may allow an unauthenticated attacker to bypass authentication via specially crafted credentials. Revised on…
-
Improper neutralization of special elements used in an OS command
CVSSv3 Score: 7.2 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder may allow an authenticated privileged attacker to execute…
-
Improper neutralization of special elements used in an OS command in webmail
CVSSv3 Score: 8.8 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder and FortiVoice may allow an authenticated attacker to execute…
-
Improper neutralization of special elements used in an OS command
CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) vulnerability [CWE-78] in FortiMail may allow an authenticated administrator with system-time read-write access to…
-
Improper neutralization of special elements used in a command
CVSSv3 Score: 7.6 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') [CWE-88] in FortiMail may allow an authenticated remote attacker with domain admin or admin privileges to delete users of…
-
Improper authentication in releasecontrol
CVSSv3 Score: 8.2 An Improper Authentication vulnerability [CWE-287] in FortiMail may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted…
-
Authorization bypass through user-controlled key
CVSSv3 Score: 7.5 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted…
-
Improper neutralization of special elements used in an os command
CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail may allow an authenticated administrator to execute unauthorized code or commands…
-
GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8
On November 10, 2026, we released versions 19.5.4, 19.4.6, 19.3.8 for GitLab Community Edition and Enterprise Edition. These versions contain important bug and security fixes, and we strongly recommend that all self-managed…
-
Long Term Support Channel Update for ChromeOS
A new LTS-150 version 150.0.7871.289 (Platform Version: 16700.70.0), is being rolled out for most ChromeOS devices. This version includes selected security fixes including: 579818899 High CVE-2026-126901 Use after free in PDF…
-
Linux kernel (NVIDIA) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
Linux kernel (NVIDIA BaseOS) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network drivers; - IPv4 networking…
-
Linux kernel (Azure CVM) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management…
-
GStreamer Good Plugins, GStreamer Base Plugins vulnerabilities
It was discovered that GStreamer Good Plugins did not properly handle certain network streams. A remote attacker could possibly use this issue to cause an application crash or execute arbitrary code. This issue only affected…
-
Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
Windows DNS Server Remote Code Execution Vulnerability
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
-
Microsoft Office Outlook Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
-
sympa - security update
It was discovered that Sympa, a mailing list manager, is prone to a path traversal and an unauthorized access bypass, which could result in access to deleted or raw archive files.…
-
tomcat10 - security update
Multiple vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in information disclosure, HTTP request smuggling or denial of service. https://security-tracker.debian.org/tracker/DSA-6623-1
-
Critical: Satellite 6.18.11 Async Update
A new release is now available for Red Hat Satellite 6.18 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Important: mysql:8.4 security update
An update for the mysql:8.4 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score…
-
Important: krb5 security, bug fix, and enhancement update
An update for krb5 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Important: pki-deps:10.6 security, bug fix, and enhancement update
An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated…
-
Moderate: xz security update
An update for xz is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS)…
-
Moderate: xorg-x11-server security update
An update for xorg-x11-server is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which…
-
Important: glib-networking security update
An update for glib-networking is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score…
Reuse this view
Same filters as JSON: /api/items?category=advisory&window=7d&limit=100. RSS for this section: feed.xml.