BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 08:46 UTC

54,471 CVEs published in the 120 days to Nov 5, 2026 · page 18 of 2,179

  1. PublishedNov 5, 2026
    CVE-2026-1223088.4 HIGH
    Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with crafted policy, rule, and trigger labels to clone sensitive Secrets from restricted namespaces into their own namespace.
    ScoreSeverityVersionVector String
    8.4HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
    8.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
  2. PublishedNov 5, 2026
    CVE-2026-1223078.3 HIGH
    Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
    7.7HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
  3. PublishedNov 5, 2026
    CVE-2026-1223068.3 HIGH
    Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
    7.7HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  4. PublishedNov 5, 2026
    CVE-2026-1223058.3 HIGH
    Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
    7.7HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  5. PublishedNov 5, 2026
    CVE-2026-1223049.4 CRITICAL
    Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.
    ScoreSeverityVersionVector String
    9.4CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    9.9CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  6. PublishedNov 5, 2026
    CVE-2026-1223039.4 CRITICAL
    Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.
    ScoreSeverityVersionVector String
    9.4CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    9.9CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  7. PublishedNov 5, 2026
    CVE-2026-1223029.3 CRITICAL
    Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. PublishedNov 5, 2026
    CVE-2026-1223012.3 LOW
    Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.
    ScoreSeverityVersionVector String
    2.3LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.1LOW3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
  9. PublishedNov 5, 2026
    CVE-2026-1221892.1 LOW
    A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  10. PublishedNov 5, 2026
    CVE-2026-1221882.1 LOW
    A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function override_config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data_path causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  11. PublishedNov 5, 2026
    CVE-2026-1221602.1 LOW
    A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base_model_name_or_path leads to inclusion of functionality from untrusted control sphere. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  12. PublishedNov 5, 2026
    CVE-2026-1221592.1 LOW
    A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  13. PublishedNov 5, 2026
    CVE-2025-66368
    Incorrect handling of SDP payload leads to a Denial of Service
  14. PublishedNov 5, 2026
    CVE-2025-66367
    Improper handling of NAS DLTransport messages may lead to a baseband crash.
  15. PublishedNov 5, 2026
    CVE-2025-66366
    Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash
  16. PublishedNov 5, 2026
    CVE-2025-66365
    Incorrect handling of SIP packets leads to baseband crashes
  17. PublishedNov 5, 2026
    CVE-2026-1221582.0 LOW
    A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.
    ScoreSeverityVersionVector String
    2.0LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    4.7MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
    5.8MEDIUM2.0CNAAV:N/AC:L/Au:M/C:P/I:P/A:P
  18. PublishedNov 5, 2026
    CVE-2026-1221572.1 LOW
    A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  19. PublishedNov 5, 2026
    CVE-2026-1221545.5 MEDIUM
    A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
    ScoreSeverityVersionVector String
    5.5MEDIUM4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    5.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    5.0MEDIUM2.0CNAAV:N/AC:L/Au:N/C:P/I:N/A:N
  20. PublishedNov 5, 2026
    CVE-2025-66364
    Continuously sending control‑plane messages causes the baseband to crashes.
  21. PublishedNov 5, 2026
    CVE-2026-1221512.1 LOW
    A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
    4.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    5.0MEDIUM2.0CNAAV:N/AC:L/Au:N/C:N/I:P/A:N
  22. PublishedNov 5, 2026
    CVE-2026-1221465.5 MEDIUM
    A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
    ScoreSeverityVersionVector String
    5.5MEDIUM4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    7.3HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  23. PublishedNov 5, 2026
    CVE-2026-1221442.1 LOW
    A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
    ScoreSeverityVersionVector String
    2.1LOW4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
    4.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    5.0MEDIUM2.0CNAAV:N/AC:L/Au:N/C:N/I:P/A:N
  24. PublishedNov 5, 2026
    CVE-2026-1220525.3 MEDIUM
    A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.
    ScoreSeverityVersionVector String
    5.3MEDIUM4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    4.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
    5.0MEDIUM2.0CNAAV:N/AC:L/Au:N/C:N/I:N/A:P
  25. PublishedNov 5, 2026
    CVE-2026-1098497.1 HIGH
    Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.
    ScoreSeverityVersionVector String
    7.1HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    6.5MEDIUM3.0CNACVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 09:10 UTC.