CVE Radar:Know what’s exposed. Fix what matters.
Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.
54,471 CVEs published in the 120 days to Nov 5, 2026 · page 24 of 2,179
- PublishedNov 4, 2026CVE-2026-1222209.1 CRITICALWPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Score Severity Version Vector String 9.1 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N 7.4 HIGH 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - PublishedNov 4, 2026CVE-2026-1221927.1 HIGHImproper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.
Score Severity Version Vector String 7.1 HIGH 4.0CNA CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 7.5 HIGH 3.1CNA CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - PublishedNov 4, 2026CVE-2026-1219339.3 CRITICALA flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Score Severity Version Vector String 9.3 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P 10.0 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 10.0 HIGH 2.0CNA AV:N/AC:L/Au:N/C:C/I:C/A:C - PublishedNov 4, 2026CVE-2026-1155745.3 MEDIUMZulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.
Score Severity Version Vector String 5.3 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - PublishedNov 4, 2026CVE-2026-1154746.5 MEDIUMZulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft recipients. A guest could thereby gain access to otherwise restricted users' profile information without sending a message. Organizations that did not restrict guest access were unaffected. This issue is fixed in version 12.2.
Score Severity Version Vector String 6.5 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - PublishedNov 4, 2026CVE-2026-1133748.6 HIGHSonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
Score Severity Version Vector String 8.6 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-1133739.1 CRITICALSonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Score Severity Version Vector String 9.1 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-1133727.1 HIGHSonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.
Score Severity Version Vector String 7.1 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-1133717.1 HIGHSonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.
Score Severity Version Vector String 7.1 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-1133707.7 HIGHSonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
Score Severity Version Vector String 7.7 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-1133696.3 MEDIUMSonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
Score Severity Version Vector String 6.3 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N - PublishedNov 4, 2026CVE-2026-1133685.3 MEDIUMSonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.
Score Severity Version Vector String 5.3 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-977016.5 MEDIUMZulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
Score Severity Version Vector String 6.5 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - PublishedNov 4, 2026CVE-2026-820338.6 HIGHDeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.
Score Severity Version Vector String 8.6 HIGH 4.0CNA CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.4 HIGH 3.1CNA CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - PublishedNov 4, 2026CVE-2026-820297.1 HIGHInvoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.
Score Severity Version Vector String 7.1 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 6.5 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - PublishedNov 4, 2026CVE-2026-631836.9 MEDIUMOmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.
Score Severity Version Vector String 6.9 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N - PublishedNov 4, 2026CVE-2026-1221488.2 HIGHIn Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.
Score Severity Version Vector String 8.2 HIGH 4.0CNA CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N - PublishedNov 4, 2026CVE-2026-1221246.1 MEDIUMOn Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.
Score Severity Version Vector String 6.1 MEDIUM 3.1CNA CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - PublishedNov 4, 2026CVE-2026-1221209.0 CRITICALIn Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
Score Severity Version Vector String 9.0 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - PublishedNov 4, 2026CVE-2026-1219329.3 CRITICALA vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Score Severity Version Vector String 9.3 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P 10.0 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 10.0 HIGH 2.0CNA AV:N/AC:L/Au:N/C:C/I:C/A:C - PublishedNov 4, 2026CVE-2026-1219318.5 HIGHA security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Score Severity Version Vector String 8.5 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P 9.1 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 8.3 HIGH 2.0CNA AV:N/AC:L/Au:M/C:C/I:C/A:C - PublishedNov 4, 2026CVE-2026-1219308.5 HIGHA weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Score Severity Version Vector String 8.5 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P 9.1 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 8.3 HIGH 2.0CNA AV:N/AC:L/Au:M/C:C/I:C/A:C - PublishedNov 4, 2026CVE-2026-1219292.0 LOWA security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Score Severity Version Vector String 2.0 LOW 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P 3.5 LOW 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N 4.0 MEDIUM 2.0CNA AV:N/AC:L/Au:S/C:N/I:P/A:N - PublishedNov 4, 2026CVE-2026-1219282.0 LOWA vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.
Score Severity Version Vector String 2.0 LOW 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P 3.5 LOW 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N 4.0 MEDIUM 2.0CNA AV:N/AC:L/Au:S/C:N/I:P/A:N - PublishedNov 4, 2026CVE-2026-1137837.4 HIGHESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.
Score Severity Version Vector String 7.4 HIGH 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H