CVEs published in November 2026

CVE-2026-100235Medium

Authorization bypass via race condition in setACL handling

CVE-2026-108500Medium

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups

CVE-2026-103582Medium

Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the.NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0

CVE-2026-108946Medium

org.apache.activemq/activemq-kahadb-store: ActiveMQ: unauthorized message access via user identifier spoofing

CVE-2026-111822High

org.apache.activemq/activemq-runtime-config: Apache ActiveMQ: Authorization bypass via improper cache invalidation

CVE-2026-111821High

org.apache.activemq/activemq-kahadb-store: activemq-kahadb-store: Denial of Service via oversized durable subscription identifiers

CVE-2026-108949Medium

Denial of Service via memory leak from rejected subscriptions

CVE-2026-9029High

Grafana Vulnerability in NetApp Products

CVE-2026-55950High

Erlang/OTP Vulnerability in NetApp Products

CVE-2026-54887Medium

Erlang/OTP Vulnerability in NetApp Products

CVE-2026-42129High

Grafana Vulnerability in NetApp Products

CVE-2026-121520High

Privilege escalation via unauthorized extended file attribute modification

CVE-2026-121522Medium

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon

CVE-2026-121541Medium

Information disclosure via untrusted multi-target Bake definitions

CVE-2026-121542Low

Information disclosure via filesystem entitlement check bypass

CVE-2026-121614High

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands

CVE-2026-95730Medium

Authenticated Buffer Overflow Vulnerability Leads to Denial-of-Service in HPE Networking VIA

CVE-2026-95729Medium

Authenticated Sensitive Information Disclosure in VIA

CVE-2026-95728High

Virtual Intranet Access: arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client

CVE-2026-95727High

Authenticated Command Injection Vulnerability in HPE Networking VIA

CVE-2026-95726High

Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIA

CVE-2026-95725High

Authenticated Local Command Injection Vulnerability in the VIA Client for Linux

CVE-2026-95724High

Virtual Intranet Access: improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA)

CVE-2026-95723High

Virtual Intranet Access: missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client

CVE-2026-95722High

Virtual Intranet Access: local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client

CVE-2026-95777Low

Fabric Composer: sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer

CVE-2026-95776Low

Fabric Composer: authenticated path traversal vulnerability exists in the API of HPE Networking Fabric Composer, which could be exploited by an authenticated low-privileged user if certain preconditions outside of the attacker's control are met

CVE-2026-95775Low

Fabric Composer: local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

CVE-2026-95774Low

Fabric Composer: sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer

CVE-2026-95773Low

Fabric Composer: denial-of-service vulnerability has been identified in HPE Networking Fabric Composer

CVE-2026-95772Medium

Fabric Composer: race condition vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95771Medium

Fabric Composer: authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer

CVE-2026-95770Medium

Fabric Composer: sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met

CVE-2026-95769Medium

Fabric Composer: audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95768Medium

Fabric Composer: privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met

CVE-2026-95767Medium

Fabric Composer: unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95766Medium

Fabric Composer: Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information

CVE-2026-95765Medium

Fabric Composer: sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer

CVE-2026-95764Medium

Fabric Composer: improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95763Medium

Fabric Composer: improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met

CVE-2026-95762Medium

Fabric Composer: insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met

CVE-2026-95761Medium

Fabric Composer: improper certificate validation vulnerability exists in HPE Networking Fabric Composer

CVE-2026-95760Medium

Fabric Composer: privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met

CVE-2026-95759Medium

Fabric Composer: Audit log bypass vulnerabilities exist in the API of HPE Networking Fabric Composer

CVE-2026-95758Medium

Fabric Composer: authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95757Medium

Fabric Composer: local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer

CVE-2026-95756Medium

Fabric Composer: command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met

CVE-2026-95755Medium

Fabric Composer: Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met

CVE-2026-95753High

Fabric Composer: privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95752High

Fabric Composer: local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95751High

Fabric Composer: improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met

CVE-2026-95750High

Fabric Composer: improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met

CVE-2026-95749High

Fabric Composer: missing integrity verification vulnerability exists in HPE Networking Fabric Composer

CVE-2026-95748High

Fabric Composer: SQL injection vulnerability exists in HPE Networking Fabric Composer

CVE-2026-95747High

Fabric Composer: privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met

CVE-2026-95746High

Fabric Composer: authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met

CVE-2026-95745High

Fabric Composer: vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack

CVE-2026-95744High

Fabric Composer: sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met

CVE-2026-95743High

Fabric Composer: Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer

CVE-2026-95742High

Fabric Composer: arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

CVE-2026-95741High

Fabric Composer: missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer

CVE-2026-95740High

Fabric Composer: improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met

CVE-2026-95739High

Fabric Composer: improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met

CVE-2026-95738High

Fabric Composer: Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met

CVE-2026-95737High

Fabric Composer: privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

CVE-2026-95736High

Fabric Composer: Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met

CVE-2026-95735High

Fabric Composer: improper certificate validation vulnerability exists in HPE Networking Fabric Composer

CVE-2026-95734High

Fabric Composer: sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level

CVE-2026-95733Critical

Fabric Composer: vulnerability exists in a component of HPE Networking Fabric Composer

CVE-2026-95732Critical

Fabric Composer: authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

CVE-2026-95731Critical

Fabric Composer: Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials

CVE-2026-93325High

Docker: Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory

CVE-2026-112917Critical

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK

CVE-2026-109594Critical

Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database

CVE-2026-109593Critical

Global Management System (GMS): unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information

CVE-2026-103916High

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace

CVE-2026-118527MediumCISA KEV

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

CVE-2026-114442Unrated

Apache HertzBeat: incomplete XPath expression validation in aliasFields

CVE-2026-119641Unrated

Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership

CVE-2026-119724High

Apache jclouds: Denial of Service via XML entity expansion

CVE-2026-76955High

buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device

CVE-2026-107441High

out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request

CVE-2026-22060Medium

Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

CVE-2026-22058Critical

Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

CVE-2026-111959Medium

Out-of-bounds read via improper validation of RunEndEncoded arrays

CVE-2026-114364Unrated

Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

CVE-2026-113687Unrated

Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

CVE-2026-113511Unrated

Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

CVE-2026-110535Unrated

Apache Syncope: AuthProfile value escalation via self-service update

CVE-2026-109083Unrated

Apache Syncope: Remote Code Execution via Flowable JUEL expression

CVE-2026-111089High

Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup

CVE-2026-95863High

Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup

CVE-2026-87718Low

Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

CVE-2026-84231High

Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

CVE-2026-84177Medium

Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

CVE-2026-84172Medium

Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

CVE-2026-84170High

Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

CVE-2026-83594High

Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names

CVE-2026-83559High

Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

CVE-2026-83539High

Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data