CVE
Common Vulnerabilities and Exposures: one public identifier per vulnerability, so everyone refers to the same issue.
Further reading: www.cve.org
Advisories that mention this term
Two unauthenticated privilege-escalation flaws in Zoom Workplace for Windows, the worst rated CVSS 9.6; fixed versions available
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
FortiOS fixes three Critical flaws, one allowing unauthenticated super-admin command execution in certain HA setups
Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.
Opening a crafted message file makes Outlook skip the external-content warning and leak NTLMv2 hashes; zero-day CVE-2026-124194 exploited and added to KEV
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
Attackers exploit Xen Orchestra empty-object login token flaw VSA-2026-062 to gain admin rights without credentials and take over XCP-ng hosts as root
France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .
SAP November Patch Day fixes four CVSS 10.0 flaws letting unauthenticated attackers compromise NetWeaver and Web Dispatcher
SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.