Snapshot 259583
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Tuskira Advisories Critical and exploited vulnerabilities, with the checks that tell you if you're exposed We publish when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. List CVE-2026-76466 9.8 Critical (Cisco as CNA, CVSS 3.1). NVD has not added its own score How to tell if CVE-2026-76466 (Cisco Expressway clusters) is reachable in your environment Cisco Expressway Series: Expressway-C and Expressway-E, virtual and appliance, when configured in a cluster Not observed November 11, 2026 CVE-2026-118383 9.5 Critical (CVSS 4.0, MongoDB as CNA); 9.0 under CVSS 3.1. NVD has not added its own score How to tell if CVE-2026-118383 (MongoDB Server replication) is reachable in your environment MongoDB Server (replica set members, including shard and config servers in sharded clusters) Not observed November 11, 2026 CVE-2026-98432 9.8 (kernel.org as CNA; Red Hat agrees); NVD has not added its own score. SUSE and Amazon rate it 8.1 Linux kernel IPv4 TCP use-after-free reachable by an unauthenticated peer during the handshake; public local root exploit claimed, no exploitation reported, Ubuntu fixes rolling out Linux kernel IPv4 TCP Not observed November 11, 2026 Xen Orchestra VSA-2026-062 No CVSS yet. Vates rates it Critical and lists its CVSS 4.0 score as not available yet. No CVE has been assigned How to tell if the Xen Orchestra login bypass (VSA-2026-062) is reachable in your environment Xen Orchestra and the Xen Orchestra Appliance (XOA), the management console for XCP-ng Reported, not on KEV November 11, 2026 N-able N-central Able2Shell N-able published CVE IDs with the fix but no CVSS scores. CCB Belgium rates it Critical. N-able calls HF2 "a critical security update" N-able N-central Able2Shell: hotfix 2026.4.1.26 is out; on-premises servers stay exposed until they run it, and Agents and Probes need upgrading too N-able N-central server, on-premises and hosted Reported, not on KEV November 11, 2026 CVE-2026-116692 9.8 (GitHub); CVE-2026-116690 is 7.5 MLflow remote code execution through third-party scorer plugins, plus a related file-read flaw (CVE-2026-116690) MLflow tracking server (pip package and ghcr.io/mlflow/mlflow images) Reported, not on KEV November 11, 2026 CVE-2026-126187 9.5 Critical (CVSS 4.0, GitHub as CNA for React). NVD has not added its own score How to tell if CVE-2026-126187 (React Server Components) is reachable in your environment React Server Components (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel); Next.js 16 Not observed November 10, 2026 CVE-2026-116606 9.3 (Barracuda and Mandiant as CNA, CVSS 4.0); companion CVE-2026-111560 is 8.6. NVD has not added its own score Barracuda Email Security Gateway Admin UI reachable without login; chained with CVE-2026-111560 it reaches root, and both are on CISA KEV Barracuda Email Security Gateway (ESG) Confirmed (CISA KEV) November 10, 2026 CVE-2026-58115 10.0 (Siemens as CNA, CVSS 3.1 and CVSS 4.0); NVD has not added its own score Siemens SIMATIC IoT2050 Node-RED interface needs no login; attackers seen deploying a Linux bot, and Example Image installs have no fix SIMATIC IoT2050 Advanced, Basic, M.2 and SM with Node-RED installed Reported, not on KEV November 10, 2026 CVE-2026-123270 9.8 Critical (CISA ADP, CVSS 3.1). CERT/CC, the CNA, published no score. NVD has not scored it, and its status is Received Redpanda Connect: upgrading to 4.111 turns the exposed management API off, and turning it back on without a login reopens it Redpanda Connect (formerly Benthos) Not observed November 9, 2026 CVE-2026-123218 9.8 (IBM as CNA, CVSS 3.1). IBM's vector says no privileges are required, but IBM's own description and CISA's entry both say the attacker needs a valid login. NVD has not added its own score IBM Aspera Faspex 5 lets any logged-in user make themselves a full administrator; on CISA KEV two days after IBM's fix, and IBM lists no workaround IBM Aspera Faspex 5 Confirmed (CISA KEV) November 9, 2026 CVE-2026-123158 8.1 (MITRE as CNA, CVSS 3.1); OpenSSH calls 10.6p2 "a critical security workaround." NVD has not added its own score OpenSSH password bypass on Alpine and other musl systems without PAM; on CISA KEV since November 9 OpenSSH sshd Confirmed (CISA KEV) November 9, 2026 CVE-2026-102895 9.8 (GitHub as CNA, CVSS 3.1); NVD has not added its own score GPUStack auth bypass gives unauthenticated admin through a same-host reverse proxy or a forged header; vendor reports exploitation, on CISA KEV since November 9 GPUStack Confirmed (CISA KEV) November 9, 2026 CVE-2026-116779 9.8 (FreeSWITCH maintainers as CNA, shown on NVD); NVD has not added its own score FreeSWITCH runs its own API commands from an unauthenticated SIP MESSAGE; maintainers report exploitation in the wild, on CISA KEV since November 9 FreeSWITCH Confirmed (CISA KEV) November 9, 2026 CVE-2026-105134 10.0 (VulDB as CNA, CVSS 3.1 and 4.0). CVE-2026-105133, the authentication bypass, is 7.3. NVD has not added its own scores AhsayCBS backup servers taken over with no login through a chained authentication bypass and command injection; exploited since October 7, on CISA KEV, and Ahsay's first patches did not fully fix it AhsayCBS Confirmed (CISA KEV) November 9, 2026 CVE-2026-106173 9.8 (Fortinet as CNA, CVSS 3.1). NVD has not added its own score Fortinet FortiSIEM 7.5.0 lets an attacker with no login write files through its gRPC service and run code; public exploit, exploitation reported by Canada's Cyber Centre FortiSIEM Reported, not on KEV November 8, 2026 CVE-2026-119757 9.3 (VulnCheck as CNA, CVSS 4.0; 9.8 in CVSS 3.1). NVD has not added its own score BTCPay Server lets an attacker with no login download the credential files for its LND Lightning node; BTCPay confirms funds were stolen BTCPay Server with LND (Lightning Network Daemon) Reported, not on KEV November 7, 2026 CVE-2026-118423 10.0 (WPScan as CNA, CVSS 3.1). NVD has marked the record Deferred and will not add its own score WP Libre Form WordPress plugin file upload that lets an attacker with no login run code on the server; no fix, plugin closed, public PoC, no exploitation reported WP Libre Form Not observed November 7, 2026 CVE-2026-123488 9.8 (VulnCheck as CNA, CVSS 3.1; 9.3 in CVSS 4.0). Craft rates it High. NVD has not added its own score Craft CMS SQL injection in element search that lets an attacker with no login make a user an administrator; public PoC, no exploitation reported Craft CMS Not observed November 7, 2026 CVE-2026-19868 7.1 (SonicWall, CVSS 3.1). CISA's scoring record on NVD gives 7.5. NVD has not added its own score SonicWall SonicOS SSL VPN SAML and MFA bypass for users holding credentials for another login method; on CISA KEV SonicOS SSL VPN (Gen7 and Gen8 firewalls) Confirmed (CISA KEV) November 6, 2026 CVE-2026-76461 9.8 (Cisco as CNA, CVSS 3.1); NVD has not added its own score Cisco Secure Email Gateway root command execution from a crafted email; on CISA KEV, 15.5.5-014 fix reissued Cisco Secure Email Gateway (AsyncOS) Confirmed (CISA KEV) November 6, 2026 CVE-2026-83542 9.8 (CISA-ADP, CVSS 3.1); Apache's CNA record carries no score and NVD has not added its own Apache OFBiz unauthenticated code execution through login-page and portal widget injection; public PoC Apache OFBiz Not observed November 6, 2026 CVE-2026-122006 9.8 (MITRE as CNA, CVSS 3.1); NVD has not added its own score Rails Active Storage file write and read from an untrusted upload when images run through ImageMagick; no Rails 7 patch Active Storage (activestorage gem) Not observed November 5, 2026 CVE-2026-13684 9.8 (Synology as CNA, CVSS 3.1, both CVEs); NVD has not added its own score Synology DSM file read/write flaws, reported as the C3RB3R ransomware entry point; Synology blames an older bug Synology DiskStation Manager (DSM) Reported, not on KEV November 4, 2026 CVE-2026-115731 9.4 (Perforce as CNA, CVSS 4.0); NVD has not added its own score Puppet Server and OpenVox Server code execution from any signed agent certificate; reaches the CA key, public PoC Puppet Server, Puppet Enterprise, OpenVox Server Not observed November 4, 2026 CVE-2026-119977 8.1 (Wordfence as CNA); NVD has not added its own score WordPress Core upgrade-window code execution flaw on CISA KEV, due Nov 6; fixed in 7.1.4 and backports to 4.7.39 WordPress Core Confirmed (CISA KEV) November 3, 2026 CVE-2026-116366 9.5 (ClickHouse as CNA, CVSS 4.0); NVD has not added its own score ClickHouse Server flaw could let an unauthenticated user run code; public PoC shows a hang, not code execution ClickHouse Server (self-hosted) Not observed November 3, 2026 CVE-2026-104935 8.6 (Ivanti as CNA, for CVE-2026-104935); NVD has not added its own score. CVE-2026-111357 is 7.0 (MITRE); CVE-2026-118527 is 4.3 (Ivanti as CNA) Ivanti Connect Secure unauthenticated command execution, chained with CVE-2026-111357 and CVE-2026-118527 to root; three CISA KEV deadlines, one already passed Connect Secure (ICS) Confirmed (CISA KEV) November 3, 2026 CVE-2026-111497 9.8 (NVD, CVSS 3.1); Google 9.2 on CVSS 4.0; Red Hat and Microsoft 8.1 Google Brotli decoder out-of-bounds write, bundled in Node.js, Envoy, .NET and Linux distributions Brotli decoder; Node.js, Envoy, Istio, .NET 8, Python brotli packages, PAN-OS, Debian, Ubuntu, Red Hat Confirmed (CISA KEV) November 3, 2026 CVE-2026-88771 9.8 (NVD) for CVE-2026-88771; Citrix rates it 9.5 on CVSS 4.0 Citrix NetScaler ADC and Gateway unauthenticated RCE exploited and on CISA KEV; same fix closes a request-smuggling bug with a new public PoC Citrix NetScaler ADC and NetScaler Gateway (customer-managed) Confirmed (CISA KEV) November 2, 2026 CVE-2026-76418 8.6 (Cisco as CNA); NVD has not added its own score. Published here because it is on CISA KEV, not for its score Cisco ASA and FTD remote access SSL VPN denial of service, exploited in the wild and on CISA KEV with a Nov 1 deadline; exposed only when secondary authentication is set on a tunnel group Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software Confirmed (CISA KEV) October 30, 2026 CVE-2026-118539 6.5 (CISA ADP, shown on NVD); NVD's own analysis pending. Drupal rates it Highly critical, 21/25 Drupal Commerce access bypass on cart, checkout and order fields; the Drupal Security Team says it is being actively exploited Commerce Core (drupal/commerce) Reported, not on KEV October 30, 2026 CVE-2026-97229 10.0 (GitLab as CNA; NVD has not added a separate NIST score) GitLab CI/CD regular expression compiler code execution (10.0); on CISA KEV since Oct 29 with a Nov 1 deadline, and the GitLab upgrade alone doesn't fix installs on their own Ruby GitLab CE and EE, self-managed Confirmed (CISA KEV) October 29, 2026 CVE-2026-93680 9.8 (IBM, for both CVE-2026-93680 and CVE-2026-110186); NVD lists IBM's score and has not added its own Langflow MCP endpoints reachable without login; two 9.8 flaws (CVE-2026-93680 and CVE-2026-110186), both fixed in 1.13.0 Langflow OSS Not observed October 29, 2026 CVE-2026-46300 7.8 (NVD, kernel.org CNA, Red Hat); SUSE scores it 8.8 Linux kernel local privilege escalation (Fragnesia), now on CISA KEV and chained with PHP2Shell Linux kernel, IPsec ESP input (net/core/skbuff.c, skb_try_coalesce) Confirmed (CISA KEV) October 29, 2026 CVE-2026-48356 9.3 (NVD); Adobe's bulletin rates it 9.6 Adobe Commerce and Magento unrestricted file upload in the cart custom-options API (PolyShell) Adobe Commerce, Adobe Commerce B2B, Magento Open Source Confirmed (CISA KEV) October 29, 2026 CVE-2026-101767 9.8 (Oracle as CNA); NVD has not added its own score Oracle E-Business Suite TCF unauthenticated SQL injection with command execution E-Business Suite (Oracle Application Object Library, Core) Reported, not on KEV October 29, 2026