Security alerts

1,054 alerts · page 18 of 53

1. Critical (CVSS 9+) Published 2026-11-05 20:36 · updated 2026-11-10 20:32

   CVE-2026-71550 SuiteCRM: LFI to RCE via AOW_WorkFlow

   Critical·CVSS 9.9 EPSS 0.40%

   Exploit status: No public exploit known

   Affects: SuiteCRM

   SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow...

2. Critical (CVSS 9+) Published 2026-11-05 20:16

   CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

   Critical·CVSS 9.3 EPSS 0.85%

   Exploit status: No public exploit known

   Affects: lmfdb/lmfdb

   LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowle...

3. Critical (CVSS 9+) Published 2026-11-05 18:40 · updated 2026-11-10 01:17

   CVE-2026-54143 OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution

   Critical·CVSS 9.8 EPSS 1.2%

   Exploit status: No public exploit known

   Affects: tinyhumansai openhuman

   OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler...

4. Critical (CVSS 9+) Published 2026-11-05 18:35 · updated 2026-11-10 01:17

   CVE-2026-54141 OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

   Critical·CVSS 9.0 EPSS 0.76%

   Exploit status: No public exploit known

   Affects: tinyhumansai openhuman

   OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without esta...

5. Critical (CVSS 9+) Published 2026-11-05 17:58 · updated 2026-11-10 01:17

   CVE-2026-119344 Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

   Critical·CVSS 9.1 EPSS 0.30%

   Exploit status: No public exploit known

   Affects: ultravioletrs cocos

   Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique ma...

6. CISA KEV addition Published 2026-11-05 17:46 · updated 2026-11-11 11:47

   CVE-2026-123158 sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be...

   High·CVSS 8.1 EPSS 18.9% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

   Exploit status: Exploited in the wild (confirmed)

   Affects: azure linux openssh, redhat/openssh, redhat/openshell and 9 more

   sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256...

7. Critical (CVSS 9+) Published 2026-11-05 16:09 · updated 2026-11-10 19:17

   CVE-2026-74841 Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode

   Critical·CVSS 9.1 EPSS 0.52%

   Exploit status: No public exploit known

   Affects: Apache OFBiz

   In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is a...

8. Critical (CVSS 9+) Published 2026-11-05 16:06 · updated 2026-11-10 20:17

   CVE-2026-81815 Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

   Critical·CVSS 9.8 EPSS 0.61%

   Exploit status: No public exploit known

   Affects: Apache OFBiz

   SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _...

9. Critical (CVSS 9+) Published 2026-11-05 16:04 · updated 2026-11-10 23:43

   CVE-2026-82907 Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

   Critical·CVSS 9.8 EPSS 0.87%

   Exploit status: No public exploit known

   Affects: Apache OFBiz, apache ofbiz

   Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issue...

10. Critical (CVSS 9+) Published 2026-11-05 15:59 · updated 2026-11-12 13:17

    CVE-2026-83542 Apache OFBiz: Unauthenticated RCE via login-page widget injection

    Critical·CVSS 9.8 EPSS 1.2%

    Exploit status: No public exploit known

    Affects: Apache OFBiz, apache ofbiz

    Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLo...

11. Critical (CVSS 9+) Published 2026-11-05 15:40 · updated 2026-11-10 19:17

    CVE-2026-105330 Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

    Critical·CVSS 9.8 EPSS 0.61%

    Exploit status: No public exploit known

    Affects: Apache OFBiz

    Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key va...

12. Critical (CVSS 9+) Published 2026-11-05 15:27 · updated 2026-11-07 18:16

    CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

    Critical·CVSS 9.1 EPSS 0.28%

    Exploit status: No public exploit known

    Affects: redhat build keycloak, redhat red hat single sign on, redhat/rhbk/keycloak-operator-bundle:26.6.9-1 and 4 more

    A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this...

13. Critical (CVSS 9+) Published 2026-11-05 13:55 · updated 2026-11-10 21:20

    CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

    Critical·CVSS 10.0 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-microservice-core, org.apache.juneau/juneau-commons

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete se...

14. Critical (CVSS 9+) Published 2026-11-05 13:54 · updated 2026-11-10 21:22

    CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

    Critical·CVSS 10.0 EPSS 0.44%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-marshall

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chro...

15. Critical (CVSS 9+) Published 2026-11-05 13:54 · updated 2026-11-10 21:21

    CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

    Critical·CVSS 10.0 EPSS 0.44%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server.

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or...

16. Critical (CVSS 9+) Published 2026-11-05 13:53 · updated 2026-11-10 21:21

    CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

    Critical·CVSS 10.0 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-client, org.apache.juneau/juneau-rest-common

    Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could r...

17. Critical (CVSS 9+) Published 2026-11-05 13:52 · updated 2026-11-10 21:21

    CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

    Critical·CVSS 10.0 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server.

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error b...

18. Critical (CVSS 9+) Published 2026-11-05 13:50 · updated 2026-11-10 21:21

    CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

    Critical·CVSS 10.0 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server., org.apache.juneau/juneau-rest-common

    Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization...

19. Critical (CVSS 9+) Published 2026-11-05 13:50

    CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

    Critical·CVSS 10.0 EPSS 0.21%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server.

    Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen req...

20. Critical (CVSS 9+) Published 2026-11-05 13:49

    CVE-2026-73098 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

    Critical·CVSS 10.0 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-marshall

    Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a clas...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).