Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

Type

Severity

Period

1,054 alerts · page 4 of 53

Critical (CVSS 9+) Published 2026-11-11 00:23

CVE-2026-126261 A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated...

CriticalCVSS 9.0

Exploit status: No public exploit known

Affects: fortinet fortimanager

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted F...
Critical (CVSS 9+) Published 2026-11-11 00:07

CVE-2026-82391 Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length

CriticalCVSS 9.1

Exploit status: No public exploit known

Affects: zephyrproject zephyr

The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len...
Critical (CVSS 9+) Published 2026-11-10 23:56 · updated 2026-11-11 13:17

CVE-2026-119017 Adobe Experience Manager | Incorrect Authorization (CWE-863)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Experience Manager 6.5

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does...
Critical (CVSS 9+) Published 2026-11-10 23:56 · updated 2026-11-11 13:17

CVE-2026-114371 Adobe Experience Manager | Incorrect Authorization (CWE-863)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Experience Manager as a Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does...
Critical (CVSS 9+) Published 2026-11-10 23:56 · updated 2026-11-11 13:17

CVE-2026-113580 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Experience Manager as a Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS

Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary cod...
Critical (CVSS 9+) Published 2026-11-10 23:56 · updated 2026-11-11 13:17

CVE-2026-113579 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Experience Manager as a Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS

Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary cod...
Critical (CVSS 9+) Published 2026-11-10 23:53

CVE-2026-125298 AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

CriticalCVSS 9.3

Exploit status: No public exploit known

Affects: AsiaInfo International Business Support System, AsiaInfo International aether-menu

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in...
Critical (CVSS 9+) Published 2026-11-10 23:53

CVE-2026-125297 AsiaInfo Business Support System (BSS) Missing Authentication

CriticalCVSS 9.3

Exploit status: No public exploit known

Affects: AsiaInfo International Business Support System, AsiaInfo International aether-menu

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform oth...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121898 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121896 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121352 Adobe Connect | Incorrect Authorization (CWE-863)

CriticalCVSS 10.0

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121908 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121887 Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Expl...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121349 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

CriticalCVSS 9.6

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevat...
Critical (CVSS 9+) Published 2026-11-10 23:30

CVE-2026-121355 Adobe Connect | Incorrect Authorization (CWE-863)

CriticalCVSS 9.1

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user intera...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121351 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

CriticalCVSS 10.0

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121889 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918)

CriticalCVSS 10.0

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121894 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121906 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

CriticalCVSS 9.9

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended...
Critical (CVSS 9+) Published 2026-11-10 23:30 · updated 2026-11-11 13:17

CVE-2026-121356 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918)

CriticalCVSS 10.0

Exploit status: No public exploit known

Affects: Adobe Connect

Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).