CVEs published in November 2026

CVE-2026-120000High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-124210Medium

Microsoft Office SharePoint Information Disclosure Vulnerability

CVE-2026-123391High

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-123390High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-112736Medium

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-111303High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-111300High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-111297High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-111296High

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-110065High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-110057Medium

Microsoft Office SharePoint Information Disclosure Vulnerability

CVE-2026-110045High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-110044High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-109504High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-109502High

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-109499High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-109497High

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-109495Medium

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-80095Critical

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-88229High

Windows Media Player Remote Code Execution Vulnerability

CVE-2026-95874High

Xbox Gaming Services Elevation of Privilege Vulnerability

CVE-2026-109472High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-109466High

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-109464High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-109456Medium

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-109455Medium

Microsoft Office SharePoint Information Disclosure Vulnerability

CVE-2026-109454Critical

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-88176High

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-57907High

privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service

CVE-2026-83528Medium

Endpoint Manager Mobile: Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information

CVE-2026-123180Medium

missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device

CVE-2026-123178Medium

insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected device

CVE-2026-107405Medium

Endpoint Manager Mobile: exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service

CVE-2026-107404Medium

Endpoint Manager Mobile: Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk

CVE-2026-105427Medium

Endpoint Manager Mobile: Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service

CVE-2026-105426Medium

Endpoint Manager Mobile: Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root

CVE-2026-123181Medium

path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges

CVE-2026-123179Medium

insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a local authenticated attacker to cause a denial of service

CVE-2026-105669Medium

Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries

CVE-2026-105425High

OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution

CVE-2026-86336High

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced

CVE-2026-86531Medium

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts

CVE-2026-87758Medium

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate

CVE-2026-97849Medium

The embedded Derby network service ignores its configured bind address and listens on all network interfaces

CVE-2026-97867Medium

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource

CVE-2026-97870Medium

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored

CVE-2026-97872Medium

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced

CVE-2026-97874Medium

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path

CVE-2026-121683Critical

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries

CVE-2026-97880Medium

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials

CVE-2026-97881Medium

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories

CVE-2026-97888Medium

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request

CVE-2026-97890Low

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g

CVE-2026-111239Medium

The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role

CVE-2026-111240Medium

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL

CVE-2026-18128Medium

Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic

CVE-2026-111241Medium

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation

CVE-2026-111242Medium

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally

CVE-2026-111243Low

negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims

CVE-2026-121653Critical

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution

CVE-2026-111244High

When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored

CVE-2026-105813Medium

User Workspace Manager: Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token

CVE-2026-111245Medium

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server

CVE-2026-111246Low

The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications

CVE-2026-111247Medium

When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm

CVE-2026-111248Low

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler

CVE-2026-111249Low

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin

CVE-2026-111250Medium

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically

CVE-2026-111251Medium

The admin service of the standalone OpenEJB server accepts stop requests without any authentication

CVE-2026-111256Medium

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication

CVE-2026-111257High

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup

CVE-2026-111258Medium

The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories

CVE-2026-111259Medium

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default

CVE-2026-111264High

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods

CVE-2026-111263Medium

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application

CVE-2026-111262Medium

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries

CVE-2026-111260Low

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy

CVE-2026-111261High

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default

CVE-2026-87756Medium

The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile

CVE-2026-87755Medium

Stateful session bean identifiers are not generated from a cryptographically secure random source

CVE-2026-86811Medium

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it

CVE-2026-86532Low

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner

CVE-2026-123082Medium

Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles

CVE-2026-85101Critical

CVE-2026-76954Critical

CVE-2026-92379High

CVE-2026-88266High

CVE-2026-87801High

CVE-2026-86343High

CVE-2026-85098High

CVE-2026-81584High

CVE-2026-81559High

CVE-2026-81558High

CVE-2026-81557High

CVE-2026-77738High

CVE-2026-75785High

CVE-2026-74857High

CVE-2026-74850High

CVE-2026-19833High

CVE-2026-19414High