Live · 98 sources · updated 22m ago

· 22:23 UTC

The Security Standard

A daily wire for defenders: vulnerabilities, advisories, research, standards.

Section

Advisories

Vendor PSIRT bulletins, CERT notes, CISA and partner-agency alerts, and distribution security notices.

1,134 matching records, 4 with confirmed exploitation.

  1. 81
    Ivanti advisory Ivanti

    November 2026 Patch Tuesday

    What's happened since October Patch Tuesday The weeks leading up to November Patch Tuesday gave defenders three clear tests of how fast they can move. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was exploited before PHP…

    Exploited CVSS 6.5 EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619CVE-2026-111497+10 more Ivanti PHP Web platform
  2. 61
    ICS advisory CISA ICS

    Siemens RUGGEDCOM APE1808

    Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised…

    EPSS 0.83 CVE-2026-111497 Palo Alto Networks Siemens Edge / VPN / firewall
  3. 61
    ICS advisory CISA ICS

    Siemens RUGGEDCOM APE1808

    Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised…

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Palo Alto Networks PHP Edge / VPN / firewall
  4. 61
    CISA alert CISA

    CISA Adds Four Known Exploited Vulnerabilities to Catalog

    CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire…

    Exploited CVE-2026-102895CVE-2026-116779CVE-2026-123158+1 more OpenSSH IBM Remote access
  5. 53
    CISA alert CISA

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability…

    Exploited CVE-2026-114713CVE-2026-123039 Check Point
  6. 53
    ICS advisory CISA ICS

    Siemens Desigo, Gridscale

    On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The…

    EPSS 0.83 Fix available CVE-2026-111497 Node.js Siemens Developer platform
  7. 49
    CISA alert CISA

    CISA Adds Six Known Exploited Vulnerabilities to Catalog

    CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference…

    Exploited CVE-2026-20320CVE-2026-111560CVE-2026-111793+3 more Cisco Barracuda
  8. 48
    ICS advisory CISA ICS

    Siemens Building Automation and Energy Products

    On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and…

    EPSS 1.00 No fix yet CVE-2026-109618CVE-2026-109619 PHP Siemens Web platform
  9. 48
    ICS advisory CISA ICS

    Siemens Industrial Edge Management

    Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the…

    EPSS 0.83 No fix yet CVE-2026-111497 Siemens OT / ICS
  10. 46
    Advisory Fortinet PSIRT

    Authentication bypass by primary weakness

    CVSSv3 Score: 9.3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially crafted request Revised on…

    CVSS 9.3 Fortinet Edge / VPN / firewall
  11. 46
    Advisory Fortinet PSIRT

    Incorrect authorization

    CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiAuthenticator may allow an attacker to bypass authentication and gain unauthorized access. Revised on 2026-11-10 00:00:00

    CVSS 9.1 Fortinet Identity
  12. 46
    Advisory Fortinet PSIRT

    Authorization bypass through user-controlled key

    CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.…

    CVSS 9.1 Fortinet Email
  13. 46
    Advisory Fortinet PSIRT

    Authentication bypass

    CVSSv3 Score: 9.0 A Use of Hard-coded Password [CWE-259] vulnerability in FortiAuthenticator may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and…

    CVSS 9.0 Fortinet Identity
  14. 46
    Advisory Fortinet PSIRT

    Numeric truncation error

    CVSSv3 Score: 9.6 A Numeric Truncation Error vulnerability [cwe-197] in FortiOS and FortiSASE bgp daemon may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted…

    CVSS 9.6 Fortinet Edge / VPN / firewall
  15. 46
    Advisory Fortinet PSIRT

    Incorrect authorization

    CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted…

    CVSS 9.1 Fortinet Email
  16. 46
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an os command

    CVSSv3 Score: 9.8 An Improper neutralization of special elements used in a command ('command injection') [CWE-77] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA…

    CVSS 9.8 Fortinet Email
  17. 46
    Advisory Fortinet PSIRT

    Improper limitation of a pathname to a restricted directory

    CVSSv3 Score: 9.8 An Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted…

    CVSS 9.8 Fortinet Email
  18. 46
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an SQL command

    CVSSv3 Score: 9.4 An Improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.…

    CVSS 9.4 Fortinet Email
  19. 42
    Advisory MSRC

    Chromium CVE-2026-126868: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126868 Microsoft Google Browser
  20. 42
    Advisory MSRC

    Chromium CVE-2026-126869: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126869 Microsoft Google Browser
  21. 42
    Advisory MSRC

    Chromium CVE-2026-126864: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126864 Microsoft Google Browser
  22. 42
    Advisory MSRC

    Chromium CVE-2026-126865: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126865 Microsoft Google Browser
  23. 42
    Advisory MSRC

    Chromium CVE-2026-126879: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126879 Microsoft Google Browser
  24. 42
    Advisory MSRC

    Chromium CVE-2026-126889: Off-by-one error

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126889 Microsoft Google Browser
  25. 42
    Advisory MSRC

    Chromium CVE-2026-126866: Incorrect authorization

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126866 Microsoft Google Browser
  26. 42
    Advisory MSRC

    Chromium CVE-2026-126878: Information leak

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126878 Microsoft Google Browser
  27. 42
    Advisory MSRC

    Chromium CVE-2026-126886: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126886 Microsoft Google Browser
  28. 42
    Advisory MSRC

    Chromium CVE-2026-126887: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126887 Microsoft Google Browser
  29. 42
    Advisory MSRC

    Chromium CVE-2026-126876: Integer overflow

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126876 Microsoft Google Browser
  30. 42
    Advisory MSRC

    Chromium CVE-2026-126884: Out of bounds read

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126884 Microsoft Google Browser
  31. 42
    Advisory MSRC

    Chromium CVE-2026-126875: Missing authorization

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126875 Microsoft Google Browser
  32. 42
    Advisory MSRC

    Chromium CVE-2026-126885: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126885 Microsoft Google Browser
  33. 42
    Advisory MSRC

    Chromium CVE-2026-126874: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126874 Microsoft Google Browser
  34. 42
    Advisory MSRC

    Chromium CVE-2026-126863: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126863 Microsoft Google Browser
  35. 42
    Advisory MSRC

    Chromium CVE-2026-126873: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126873 Microsoft Google Browser
  36. 42
    Advisory MSRC

    Chromium CVE-2026-126883: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126883 Microsoft Google Browser
  37. 42
    Advisory MSRC

    Chromium CVE-2026-126872: Incorrect authorization

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126872 Microsoft Google Browser
  38. 42
    Advisory MSRC

    Chromium CVE-2026-126880: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126880 Microsoft Google Browser
  39. 42
    Advisory MSRC

    Chromium CVE-2026-126871: Out of bounds read

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126871 Microsoft Google Browser
  40. 42
    Advisory MSRC

    Chromium CVE-2026-126881: Improper initialization

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126881 Microsoft Google Browser
  41. 42
    Advisory MSRC

    Chromium CVE-2026-126870: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126870 Microsoft Google Browser
  42. 42
    Advisory MSRC

    Chromium CVE-2026-126843: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126843 Microsoft Google Browser
  43. 42
    Advisory MSRC

    Chromium CVE-2026-126907: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126907 Microsoft Google Browser
  44. 42
    Advisory MSRC

    Chromium CVE-2026-126840: Out of bounds write

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126840 Microsoft Google Browser
  45. 42
    Advisory MSRC

    Chromium CVE-2026-126841: Out of bounds read

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126841 Microsoft Google Browser
  46. 42
    Advisory MSRC

    Chromium CVE-2026-126854: Incorrect authorization

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126854 Microsoft Google Browser
  47. 42
    Advisory MSRC

    Chromium CVE-2026-125344: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-125344 Microsoft Google Browser
  48. 42
    Advisory MSRC

    Chromium CVE-2026-126847: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126847 Microsoft Google Browser
  49. 42
    Advisory MSRC

    Chromium CVE-2026-126857: Out of bounds read

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126857 Microsoft Google Browser
  50. 42
    Advisory MSRC

    Chromium CVE-2026-126903: Improper state validation

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126903 Microsoft Google Browser
  51. 42
    Advisory MSRC

    Chromium CVE-2026-126844: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126844 Microsoft Google Browser
  52. 42
    Advisory MSRC

    Chromium CVE-2026-126856: Incomplete cleanup

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126856 Microsoft Google Browser
  53. 42
    Advisory MSRC

    Chromium CVE-2026-126845: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126845 Microsoft Google Browser
  54. 42
    Advisory MSRC

    Chromium CVE-2026-126851: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126851 Microsoft Google Browser
  55. 42
    Advisory MSRC

    Chromium CVE-2026-126901: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126901 Microsoft Google Browser
  56. 42
    Advisory MSRC

    Chromium CVE-2026-126900: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126900 Microsoft Google Browser
  57. 42
    Advisory MSRC

    Chromium CVE-2026-126853: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126853 Microsoft Google Browser
  58. 42
    Advisory MSRC

    Chromium CVE-2026-126848: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126848 Microsoft Google Browser
  59. 42
    Advisory MSRC

    Chromium CVE-2026-126852: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126852 Microsoft Google Browser
  60. 42
    Advisory MSRC

    Chromium CVE-2026-125342: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-125342 Microsoft Google Browser
  61. 42
    Advisory MSRC

    Chromium CVE-2026-126849: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126849 Microsoft Google Browser
  62. 42
    Advisory MSRC

    Chromium CVE-2026-126859: Link following

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126859 Microsoft Google Browser
  63. 42
    Advisory MSRC

    Chromium CVE-2026-126858: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126858 Microsoft Google Browser
  64. 42
    Advisory MSRC

    Chromium CVE-2026-125348: Out of bounds write

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-125348 Microsoft Google Browser
  65. 42
    Advisory MSRC

    Chromium CVE-2026-126919: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126919 Microsoft Google Browser
  66. 42
    Advisory MSRC

    Chromium CVE-2026-126891: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126891 Microsoft Google Browser
  67. 42
    Advisory MSRC

    Chromium CVE-2026-126916: Integer overflow

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126916 Microsoft Google Browser
  68. 42
    Advisory MSRC

    Chromium CVE-2026-126910: Type confusion

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126910 Microsoft Google Browser
  69. 42
    Advisory MSRC

    Chromium CVE-2026-126895: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126895 Microsoft Google Browser
  70. 42
    Advisory MSRC

    Chromium CVE-2026-126911: Use after free

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126911 Microsoft Google Browser
  71. 42
    Advisory MSRC

    Chromium CVE-2026-126912: Buffer overflow

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126912 Microsoft Google Browser
  72. 42
    Advisory MSRC

    Chromium CVE-2026-126896: Missing authorization

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126896 Microsoft Google Browser
  73. 42
    Advisory MSRC

    Chromium CVE-2026-126898: Uninitialized resource

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

    Fix available CVE-2026-126898 Microsoft Google Browser
  74. 40
    CCCS advisory CCCS

    N-able security advisory (AV26-1143)

    CVE-2026-125883 N-able Remote access
  75. 40
    Ubuntu notice Ubuntu

    Unbound vulnerabilities

    USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding update for…

    CVE-2026-80225CVE-2026-81634CVE-2026-85501+5 more Canonical Operating system
  76. 40
    Advisory MSRC

    Windows Hyper-V Remote Code Execution Vulnerability

    Updated an acknowledgement. This is an informational change only.

    CVE-2026-102214 Microsoft Operating system
  77. 39
    CERT-EU advisory CERT-EU

    Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

    On 12 November 2026, the Cloud Software Group published security bulletins for its Citrix products addressing 28 memory flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway. One of these vulnerabilities, CVE-2026-120868…

    CVE-2026-120868 Citrix Edge / VPN / firewall
  78. 39
    Cisco advisory Cisco PSIRT

    Cisco Identity Services Engine Authorization Bypass Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the…

    Fix available CVE-2026-20183CVE-2026-20285CVE-2026-20286 Cisco Identity
  79. 39
    Advisory Fortinet PSIRT

    FGFM elevation before registration password is verified

    CVSSv3 Score: 9.0 An improper authorization vulnerability in FortiManager FGFM may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets. Revised on 2026-11-10 00:00:00

    CVSS 9.0 Fortinet Network management
  80. 39
    Advisory Fortinet PSIRT

    Authorization bypass through user-controlled key in dmserver

    CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via…

    CVSS 9.1 Fortinet Network management
  81. 38
    Advisory MSRC

    Remote Desktop Services Remote Code Execution Vulnerability

    Updated an acknowledgement. This is an informational change only.

    CVE-2026-108401 Microsoft Remote access
  82. 38
    Advisory MSRC

    Windows NTLM Spoofing Vulnerability

    Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.

    CVE-2026-121680 Microsoft Collaboration
  83. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an SQL command

    CVSSv3 Score: 8.8 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')[CWE-89] in FortiAuthenticator may allow an authenticated attacker to execute unauthorized SQL commands on the underlying…

    CVSS 8.8 Fortinet Identity
  84. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an ldap query

    CVSSv3 Score: 8.2 An Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')[CWE-90] in FortiAuthenticator may allow an authenticated attacker to bypass authentication. Successful exploitation…

    CVSS 8.2 Fortinet Identity
  85. 38
    Advisory Fortinet PSIRT

    Improper privilege management

    CVSSv3 Score: 7.2 An Improper Privilege Management vulnerability[CWE-269] in FortiAuthenticator may allow an authenticated attacker to escalate privileges. Revised on 2026-11-10 00:00:00

    CVSS 7.2 Fortinet Identity
  86. 38
    Advisory Fortinet PSIRT

    Allocation of resources without limits or throttling in fastapi

    CVSSv3 Score: 7.5 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiAuthenticator may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of…

    CVSS 7.5 Fortinet Identity
  87. 38
    Advisory Fortinet PSIRT

    Authorization bypass through user-controlled key

    CVSSv3 Score: 8.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users'…

    CVSS 8.1 Fortinet Email
  88. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements in output used by a downstream component in sshd

    CVSSv3 Score: 7.4 A Path Traversal vulnerability [cwe-24] in FortiOS, FortiSASE, FortiProxy and FortiPam ssh daemon may allow an unauthenticated attacker to bypass authentication via specially crafted credentials. Revised on…

    CVSS 7.4 Fortinet OpenSSH Edge / VPN / firewall
  89. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an OS command

    CVSSv3 Score: 7.2 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder may allow an authenticated privileged attacker to execute…

    CVSS 7.2 Fortinet Email
  90. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an OS command in webmail

    CVSSv3 Score: 8.8 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder and FortiVoice may allow an authenticated attacker to execute…

    CVSS 8.8 Fortinet Email
  91. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an OS command

    CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) vulnerability [CWE-78] in FortiMail may allow an authenticated administrator with system-time read-write access to…

    CVSS 7.2 Fortinet Email
  92. 38
    Advisory Fortinet PSIRT

    SSLVPN Improper Certificate Validation

    CVSSv3 Score: 7.7 An improper certificate validation vulnerability [CWE-295] in FortiOS SSLVPN may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN…

    CVSS 7.7 Fortinet Edge / VPN / firewall
  93. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in a command

    CVSSv3 Score: 7.6 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') [CWE-88] in FortiMail may allow an authenticated remote attacker with domain admin or admin privileges to delete users of…

    CVSS 7.6 Fortinet Email
  94. 38
    Advisory Fortinet PSIRT

    Improper authentication in releasecontrol

    CVSSv3 Score: 8.2 An Improper Authentication vulnerability [CWE-287] in FortiMail may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted…

    CVSS 8.2 Fortinet Email
  95. 38
    Advisory Fortinet PSIRT

    Authorization bypass through user-controlled key

    CVSSv3 Score: 7.5 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted…

    CVSS 7.5 Fortinet Email
  96. 38
    Advisory Fortinet PSIRT

    Improper neutralization of special elements used in an os command

    CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail may allow an authenticated administrator to execute unauthorized code or commands…

    CVSS 7.2 Fortinet Email
  97. 38
    GitLab release GitLab

    GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8

    On November 10, 2026, we released versions 19.5.4, 19.4.6, 19.3.8 for GitLab Community Edition and Enterprise Edition. These versions contain important bug and security fixes, and we strongly recommend that all self-managed…

    Fix available CVE-2026-105437 GitLab Developer platform
  98. 37
    Advisory MSRC

    Microsoft Windows Codecs Library Remote Code Execution Vulnerability

    Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.

    CVE-2026-113749 Microsoft Operating system
  99. 37
    Advisory MSRC

    Windows Kernel Elevation of Privilege Vulnerability

    Updated an acknowledgement. This is an informational change only.

    CVE-2026-109473 Microsoft Operating system
  100. 37
    Ubuntu notice Ubuntu

    Linux kernel (FIPS) vulnerabilities

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Hardware monitoring…

    CVE-2025-21656CVE-2026-63940CVE-2026-74350+2 more Canonical Linux kernel Operating system

Reuse this view

Same filters as JSON: /api/items?category=advisory&window=7d&limit=100. RSS for this section: feed.xml.

Keyboard

j / k
Next / previous item
o or Enter
Open the original source
i
Open the item page
s
Save or unsave for later
/
Focus search
g then f v a r n s
Go to front, vulnerabilities, advisories, research, news, standards
t
Toggle theme
?
This help