Domain
Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.
On November 5, 2026, OpenSSH released version 10.
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
According to Security NEXT, SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support .
According to Security NEXT, on October 28, 2026, Yamaha disclosed two vulnerabilities in its NWR100 wireless routers and released fixed firmware .
In FreeSWITCH 1.
On October 28, Orange Electronic issued a material information filing on MOPS stating that some of its local area network storage devices had been hit by a ransomware attack, and its cybersecurity team immediately activated defense mechanisms and network isolation .
On 2026-11-06, TWCERT/CC reported two heap-based buffer overflow vulnerabilities in WatchGuard Fireware OS, tracked as CVE-2026-112709 and CVE-2026-112710 (CVSS 4.
On 2026-11-06, TWCERT/CC reported multiple high-risk vulnerabilities in HPE Networking AOS-10 and AOS-8, including authentication bypass, buffer overflow, SQL injection, command injection, and sensitive information disclosure .
On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.
Crypto exchange Bitget confirmed that, based on the latest on-chain tracing, about $387.
On 2026-09-22, CISA added CVE-2026-93616 (Check Point Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-22, CISA added CVE-2026-85102 (Check Point Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-16, CISA added CVE-2026-76460 (Cisco Identity Services Engine) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-14, CISA added CVE-2026-76461 (Cisco Secure Email Gateway) to its Known Exploited Vulnerabilities (KEV) catalog .
Japan's Digital Agency said on September 11 that its Government Solution Service (GSS) was accessed without authorization: on June 25 it detected mass file access using a maintenance account, and on July 9 confirmed a third party had entered through a VPN device vulnerability .
On 2026-09-09, CISA added CVE-2026-19490 (Citrix NetScaler) to its Known Exploited Vulnerabilities (KEV) Catalog .
On 2026-09-09, CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management) to its Known Exploited Vulnerabilities (KEV) Catalog .
On 2026-09-09, CISA added CVE-2025-25249 (Fortinet Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-02, CISA added CVE-2026-83549 (SonicWall SMA1000 Appliances) to its Known Exploited Vulnerabilities (KEV) catalog .