Security alerts

1,054 alerts · page 1 of 53

1. Critical (CVSS 9+) Published 2026-11-12 14:00

   RUSTSEC-2026-0501 Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key

   Critical·CVSS 9.1

   Exploit status: No public exploit known

   Affects: crates.io bsv-rs

   KeyShares::from_backup_format (the Shamir backup share reader, public since 0.2.0, the crate's first release) accepted a share whose x coordinate is 0, and KeyShares::recover_private_key interpolates the shares at x = 0 to recover the key. At an x of 0 the interpolation answers t...

2. Critical (CVSS 9+) Published 2026-11-12 11:45

   CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints

   Critical·CVSS 9.2

   Exploit status: No public exploit known

   Affects: misp-modules

   The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the modul...

3. Critical (CVSS 9+) Published 2026-11-12 10:53

   CVE-2026-90908 Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator

   Critical·CVSS 9.3

   Exploit status: No public exploit known

   Affects: Azul Payara Payara Server, Azul Payara Payara Micro

   A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrat...

4. Critical (CVSS 9+) Published 2026-11-12 10:43

   CVE-2026-110003 Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution

   Critical·CVSS 9.3

   Exploit status: No public exploit known

   Affects: Azul Payara Payara Server

   A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-reject...

5. Critical (CVSS 9+) Published 2026-11-12 08:55

   CVE-2026-12591 Privilege Escalation

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: Zohocorp M365 Manager Plus

   Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code ex...

6. Critical (CVSS 9+) Published 2026-11-12 08:48

   CVE-2026-12507 Authenticated remote code execution

   Critical·CVSS 9.1

   Exploit status: No public exploit known

   Affects: Zohocorp AssetExplorer, Zohocorp servicedesk plus, Zohocorp ServiceDesk Plus MSP and 1 more

   Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An aut...

7. Critical (CVSS 9+) Published 2026-11-12 08:18

   CVE-2026-8333 TimePictra Stored Cross-site Scripting

   Critical·CVSS 9.4

   Exploit status: No public exploit known

   Affects: Microchip TimePictra

   A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page

8. Critical (CVSS 9+) Published 2026-11-12 05:41

   CVE-2026-76954 An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4....

   Critical·CVSS 9.8

   Exploit status: No public exploit known

   Affects: Synology DiskStation Manager (DSM)

   An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct d...

9. Critical (CVSS 9+) Published 2026-11-12 03:17

   CVE-2026-126785 A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect...

   Critical·CVSS 9.3

   Exploit status: No public exploit known

   A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was con...

10. Critical (CVSS 9+) Published 2026-11-11 23:51

    CVE-2026-67449 Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    Affects: portabase

    Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticate...

11. Critical (CVSS 9+) Published 2026-11-11 23:35 · updated 2026-11-12 13:17

    CVE-2026-126229 A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2...

    Critical·CVSS 9.1

    Exploit status: No public exploit known

    Affects: fortinet fortimanager, fortinet fortianalyzer, fortinet fortimanagercloud and 1 more

    A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, Fo...

12. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126262 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4...

    Critical·CVSS 9.3

    Exploit status: No public exploit known

    Affects: fortinet fortianalyzer, fortinet fortimanager

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, Forti...

13. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126259 A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthentic...

    Critical·CVSS 9.0

    Exploit status: No public exploit known

    Affects: fortinet fortios

    A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute com...

14. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126263 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7...

    Critical·CVSS 9.4

    Exploit status: No public exploit known

    Affects: fortinet fortimail

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or command...

15. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126257 A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential valida...

    Critical·CVSS 9.0

    Exploit status: No public exploit known

    Affects: fortinet fortiauthenticator

    A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unautho...

16. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126254 A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp ne...

    Critical·CVSS 9.6

    Exploit status: No public exploit known

    Affects: fortinet fortios

    A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a spe...

17. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126253 A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an....

    Critical·CVSS 9.3

    Exploit status: No public exploit known

    Affects: fortinet fortios

    A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request

18. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126251 A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized...

    Critical·CVSS 9.1

    Exploit status: No public exploit known

    Affects: fortinet fortiauthenticator

    A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.

19. Critical (CVSS 9+) Published 2026-11-11 23:30

    CVE-2026-126170 A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7...

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    Affects: fortinet fortimanager, fortinet fortianalyzer, fortinet fortimanagercloud and 2 more

    A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0....

20. Critical (CVSS 9+) Published 2026-11-11 23:29

    CVE-2026-126164 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7...

    Critical·CVSS 9.4

    Exploit status: No public exploit known

    Affects: fortinet fortimail

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execut...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).