CVE Radar:Know what’s exposed. Fix what matters.
Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.
54,471 CVEs published in the 120 days to Nov 5, 2026 · page 14 of 2,179
- PublishedNov 5, 2026CVE-2026-730958.7 HIGHAllocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Score Severity Version Vector String 8.7 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - PublishedNov 5, 2026CVE-2026-1230195.5 MEDIUMA weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functionality from untrusted control sphere. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Score Severity Version Vector String 5.5 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P 7.3 HIGH 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 HIGH 2.0CNA AV:N/AC:L/Au:N/C:P/I:P/A:P - PublishedNov 5, 2026CVE-2026-1230185.5 MEDIUMA security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Score Severity Version Vector String 5.5 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P 8.3 HIGH 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L 7.5 HIGH 2.0CNA AV:N/AC:L/Au:N/C:P/I:P/A:P - PublishedNov 5, 2026CVE-2026-12148910.0 CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Score Severity Version Vector String 10.0 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - PublishedNov 5, 2026CVE-2026-1230365.5 MEDIUMA flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.
Score Severity Version Vector String 5.5 MEDIUM 3.1CNA CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - PublishedNov 5, 2026CVE-2026-1188698.7 HIGHAn OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
Score Severity Version Vector String 8.7 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.8 HIGH 3.0CNA CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - PublishedNov 5, 2026CVE-2026-1176795.1 MEDIUMA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
Score Severity Version Vector String 5.1 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N 5.4 MEDIUM 3.0CNA CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - PublishedNov 5, 2026CVE-2026-1120726.5 MEDIUMvault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.
Score Severity Version Vector String 6.5 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - PublishedNov 5, 2026CVE-2026-1094087.4 HIGHvault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.
Score Severity Version Vector String 7.4 HIGH 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - PublishedNov 5, 2026CVE-2026-1077762.2 LOWThe Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
Score Severity Version Vector String 2.2 LOW 3.1CNA CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - PublishedNov 5, 2026CVE-2026-1001099.8 CRITICALThe Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
Score Severity Version Vector String 9.8 CRITICAL 3.0CNA CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - PublishedNov 5, 2026CVE-2026-1230338.3 HIGHAuthentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root. middlewared registers the HA peer-authentication hook (ha_permission) unconditionally, with no failover-licence or heartbeat-interface check. An unauthenticated connection whose TCP peer address is a hardcoded HA heartbeat address (169.254.10.1 or 169.254.10.2) and whose peer port is <= 1024 is granted a node credential that is authorized for every API method and treated as full administrator. Both conditions are properties of the attacker's own socket, and thus an attacker on the same layer-2 segment satisfies them without forging anything. The hook is present on non-HA, unlicensed, single-node Community Edition installations. The fix additionally requires that the connection terminate on the HA heartbeat listener (a local address/port the attacker cannot control).
Score Severity Version Vector String 8.3 HIGH 3.1CNA CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - PublishedNov 5, 2026CVE-2026-1230297.5 HIGHWowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
Score Severity Version Vector String 7.5 HIGH 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - PublishedNov 5, 2026CVE-2026-1230259.4 CRITICALAn OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
Score Severity Version Vector String 9.4 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - PublishedNov 5, 2026CVE-2026-1230176.5 MEDIUMGodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
Score Severity Version Vector String 6.5 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - PublishedNov 5, 2026CVE-2026-910496.4 MEDIUMThe EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
Score Severity Version Vector String 6.4 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - PublishedNov 5, 2026CVE-2026-909674.3 MEDIUMThe Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
Score Severity Version Vector String 4.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - PublishedNov 5, 2026CVE-2026-909664.3 MEDIUMThe Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.
Score Severity Version Vector String 4.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - PublishedNov 5, 2026CVE-2026-909655.3 MEDIUMThe Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
Score Severity Version Vector String 5.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - PublishedNov 5, 2026CVE-2026-909645.3 MEDIUMThe Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
Score Severity Version Vector String 5.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - PublishedNov 5, 2026CVE-2026-909635.3 MEDIUMThe Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
Score Severity Version Vector String 5.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - PublishedNov 5, 2026CVE-2026-888143.7 LOWThe YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
Score Severity Version Vector String 3.7 LOW 3.1CISA-ADP CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - PublishedNov 5, 2026CVE-2026-878565.3 MEDIUMThe Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
Score Severity Version Vector String 5.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - PublishedNov 5, 2026CVE-2026-867955.3 MEDIUMThe Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
Score Severity Version Vector String 5.3 MEDIUM 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - PublishedNov 5, 2026CVE-2026-864428.2 HIGHThe WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
Score Severity Version Vector String 8.2 HIGH 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N