CVEs published in November 2026

CVE-2026-77709High

pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service

CVE-2026-77708High

pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service

CVE-2026-19868HighCISA KEV

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

CVE-2026-82308High

pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service

CVE-2026-107154High

session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations

CVE-2026-107155High

permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations

CVE-2026-90436Critical

Remote Code Execution in Confluence Data Center

CVE-2026-85111High

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages

CVE-2026-85108High

Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

CVE-2026-76168High

Apache James: ManageSieve file implementation cross-user path traversal

CVE-2026-74756Low

Apache James: WebAdmin exposed without authentication on official Docker default

CVE-2026-76171Low

Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

CVE-2026-49939Medium

Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol

CVE-2025-66621Medium

Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

CVE-2026-69304Medium

ASP.NET Core Vulnerability in NetApp Products

CVE-2026-2261High

FreeBSD Vulnerability in NetApp Products

CVE-2026-101311High

CVE-2026-101310High

CVE-2026-101309High

CVE-2026-101308Medium

FreeBSD Vulnerability in NetApp Products

CVE-2026-101307High

FreeBSD Vulnerability in NetApp Products

CVE-2026-123158CriticalCISA KEV

OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

CVE-2026-66903Medium

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz

CVE-2026-71901High

Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz

CVE-2026-68524High

Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

CVE-2026-73577High

Apache OFBiz: Unauthenticated path-suffix view authorization bypass

CVE-2026-73578High

Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact

CVE-2026-73580Medium

Apache OFBiz: Unauthenticated HR organization and employee disclosure

CVE-2026-74841High

Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode

CVE-2026-76150High

Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage

CVE-2026-81734Medium

Apache OFBiz: Missing authorization - catalog quick-admin product writes

CVE-2026-76152Medium

Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services

CVE-2026-81744High

Apache OFBiz: Authorization bypass - self-grant content OWNER

CVE-2026-81808Medium

Apache OFBiz: Missing authorization - search-result bulk catalog mutation

CVE-2026-81815High

Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

CVE-2026-81816Low

XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response

CVE-2026-81828High

Apache OFBiz: Server-side request forgery in SurveyWrapper

CVE-2026-82894High

Apache OFBiz: Content renderer runs a service name stored on the row

CVE-2026-82902Medium

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result

CVE-2026-82904High

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment

CVE-2026-82907Critical

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server

CVE-2026-82910High

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g

CVE-2026-82912High

Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication

CVE-2026-82916High

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list

CVE-2026-82960High

Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval, whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection

CVE-2026-83538Medium

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

CVE-2026-83542Critical

Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page

CVE-2026-84183High

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route

CVE-2026-84728Medium

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data

CVE-2026-85627High

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy

CVE-2026-92887High

Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a.rest.xml operation

CVE-2026-97355Medium

Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service

CVE-2026-97356High

Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass

CVE-2026-100168Medium

Apache OFBiz: Missing Authorization vulnerability

CVE-2026-100228High

Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation

CVE-2026-105325Medium

Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations

CVE-2026-105330Medium

Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

CVE-2026-105461Medium

Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities

CVE-2026-109129High

Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification

CVE-2026-109837High

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association

CVE-2026-109856High

Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation

CVE-2026-109928High

Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover

CVE-2026-114229Medium

Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session

CVE-2026-114233High

Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders

CVE-2026-114235Medium

Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification

CVE-2026-114271Medium

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification

CVE-2026-114272Medium

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure

CVE-2026-114277High

Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts

CVE-2026-103866Low

HTTP request smuggling via malformed query and form parsing

CVE-2026-103864Low

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

CVE-2026-103863Medium

Stored Cross-Site Scripting via header protection bypass

CVE-2026-121489Critical

Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

CVE-2026-96677Critical

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau

CVE-2026-73117Critical

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau

CVE-2026-73116Critical

Insufficiently Protected Credentials vulnerability in Apache Juneau

CVE-2026-73101Critical

Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

CVE-2026-73100Critical

Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

CVE-2026-73099Critical

Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau

CVE-2026-73098Critical

Improper control of dynamically-loaded code vulnerability in Apache Juneau

CVE-2026-73095High

Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau

CVE-2026-121637High

improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes

CVE-2026-121639Critical

Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration

CVE-2026-121638Critical

Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers

CVE-2026-121640Critical

Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services

CVE-2026-59267Medium

crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier

CVE-2026-90632Medium

Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF

CVE-2026-90634High

uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption

CVE-2026-90631Low

Apache OpenOffice documents can contain links

CVE-2026-90629High

uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption

CVE-2026-90628High

uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code

CVE-2026-90627Medium

The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user

CVE-2026-90626High

uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption

CVE-2026-90624High

unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write

CVE-2026-59268High

out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas

CVE-2026-59264High

The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access

CVE-2026-59263Low

manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user

CVE-2026-100302High

Denial of Service via unbounded multiRead response memory allocation

CVE-2026-115448High

Denial of Service via deeply nested znodes during snapshot creation

CVE-2026-100300High

Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable

CVE-2026-100252High

Privilege escalation via improper SASL authorization identity validation