Category
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .
SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.
Apple released iOS and iPadOS 27.
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
The Roundcube team released Webmail security updates 1.
BleepingComputer reports that researcher Sean Bales publicly disclosed more than 30 N-able N-central vulnerabilities on Nov 8 without notifying the vendor and released proof-of-concept exploits in a GitHub repository called Able2Shell, the most critical chain using an unauthenticated XXE flaw to run commands on the server and create an admin account .
A researcher known as forcequit published worse_query, an iOS sandbox-escape proof of concept, on GitHub on November 8; it lets an app read other apps' data containers on iOS 26 and 27 .
The Hacker News reports that LNbits, an open-source Bitcoin Lightning wallet system, told all operators on Nov 8 to shut down their servers immediately because of a wave of attacks, saying several security fixes are pending .
IBM published a bulletin on Nov 7 saying Aspera Faspex 5.
Researchers Shubham Shah and Sam Curry disclosed on Nov 7 that in early 2026 they found a vulnerability chain giving them remote code execution on production ForgeRock servers handling customer logins for two unnamed automakers, letting them create a valid session for any customer account and locate, unlock and remotely start connected vehicles .
According to Security NEXT, NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions .
On November 5, 2026, OpenSSH released version 10.
CVE-2026-19868 in SonicWall SonicOS SSLVPN can let a user holding valid credentials for another authentication method bypass SAML authentication, and possibly the MFA that SAML enforces .
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
According to Security NEXT, SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .