Security alerts

1,054 alerts · page 1 of 53

1. Critical (CVSS 9+) Published 2026-11-12 14:16

   CVE-2026-19422 Authentication Bypass

   Critical·CVSS 9.1

   Exploit status: No public exploit known

   Affects: Zohocorp DDI Central

   Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modificatio...

2. Critical (CVSS 9+) Published 2026-11-12 14:05

   CVE-2026-127046 MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

   Critical·CVSS 9.2

   Exploit status: No public exploit known

   Affects: misp modules

   The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally...

3. Critical (CVSS 9+) Published 2026-11-12 14:00

   RUSTSEC-2026-0501 Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key

   Critical·CVSS 9.1

   Exploit status: No public exploit known

   Affects: crates.io bsv-rs

   KeyShares::from_backup_format (the Shamir backup share reader, public since 0.2.0, the crate's first release) accepted a share whose x coordinate is 0, and KeyShares::recover_private_key interpolates the shares at x = 0 to recover the key. At an x of 0 the interpolation answers t...

4. Critical (CVSS 9+) Published 2026-11-12 11:45

   CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints

   Critical·CVSS 9.2

   Exploit status: No public exploit known

   Affects: misp-modules

   The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the modul...

5. Critical (CVSS 9+) Published 2026-11-12 10:53

   CVE-2026-90908 Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator

   Critical·CVSS 9.3

   Exploit status: No public exploit known

   Affects: Azul Payara Payara Server, Azul Payara Payara Micro

   A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrat...

6. Critical (CVSS 9+) Published 2026-11-12 10:43

   CVE-2026-110003 Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution

   Critical·CVSS 9.3

   Exploit status: No public exploit known

   Affects: Azul Payara Payara Server

   A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-reject...

7. Critical (CVSS 9+) Published 2026-11-12 08:55

   CVE-2026-12591 Privilege Escalation

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: Zohocorp M365 Manager Plus

   Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code ex...

8. Critical (CVSS 9+) Published 2026-11-12 08:48

   CVE-2026-12507 Authenticated remote code execution

   Critical·CVSS 9.1

   Exploit status: No public exploit known

   Affects: Zohocorp AssetExplorer, Zohocorp servicedesk plus, Zohocorp ServiceDesk Plus MSP and 1 more

   Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An aut...

9. Critical (CVSS 9+) Published 2026-11-12 08:18

   CVE-2026-8333 TimePictra Stored Cross-site Scripting

   Critical·CVSS 9.4

   Exploit status: No public exploit known

   Affects: Microchip TimePictra

   A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page

10. Critical (CVSS 9+) Published 2026-11-12 08:00

    CVE-2026-124815 Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

    Critical·CVSS 10.0

    Exploit status: No public exploit known

    The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting d...

11. Critical (CVSS 9+) Published 2026-11-12 08:00

    CVE-2026-124814 Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

12. Critical (CVSS 9+) Published 2026-11-12 08:00

    CVE-2026-110959 Descope < 1.2.0 - Unauthenticated Account Takeover

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supply...

13. Critical (CVSS 9+) Published 2026-11-12 05:41

    CVE-2026-76954 An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4....

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    Affects: Synology DiskStation Manager (DSM)

    An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct d...

14. Critical (CVSS 9+) Published 2026-11-12 03:17

    CVE-2026-126785 A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect...

    Critical·CVSS 9.3

    Exploit status: No public exploit known

    A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was con...

15. Critical (CVSS 9+) Published 2026-11-11 23:51

    CVE-2026-67449 Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    Affects: portabase

    Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticate...

16. Critical (CVSS 9+) Published 2026-11-11 23:35 · updated 2026-11-12 13:17

    CVE-2026-126229 A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2...

    Critical·CVSS 9.1

    Exploit status: No public exploit known

    Affects: fortinet fortimanager, fortinet fortianalyzer, fortinet fortimanagercloud and 1 more

    A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, Fo...

17. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126262 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4...

    Critical·CVSS 9.3

    Exploit status: No public exploit known

    Affects: fortinet fortianalyzer, fortinet fortimanager

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, Forti...

18. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126259 A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthentic...

    Critical·CVSS 9.0

    Exploit status: No public exploit known

    Affects: fortinet fortios

    A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute com...

19. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126263 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7...

    Critical·CVSS 9.4

    Exploit status: No public exploit known

    Affects: fortinet fortimail

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or command...

20. Critical (CVSS 9+) Published 2026-11-11 23:31

    CVE-2026-126257 A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential valida...

    Critical·CVSS 9.0

    Exploit status: No public exploit known

    Affects: fortinet fortiauthenticator

    A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unautho...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).