Industry
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .
SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.
Apple released iOS and iPadOS 27.
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
The Roundcube team released Webmail security updates 1.
Wiz says an attacker used IAM credentials from an AWS account associated with Qubole between Oct 14 and 26, 2026 to assume IAM roles that multiple customers had created to trust Qubole and enter their AWS environments .
A researcher known as forcequit published worse_query, an iOS sandbox-escape proof of concept, on GitHub on November 8; it lets an app read other apps' data containers on iOS 26 and 27 .
IBM published a bulletin on Nov 7 saying Aspera Faspex 5.
Taiwan Fund for Children and Families (TFCF) announced on November 7 that starting November 6, donors reported receiving fraudulent messages impersonating the foundation and directing them to add a fake official LINE account .
According to iThome, Emerging Stock Market health supplement company Tensall Bio-Tech (7889) published a material announcement on the Market Observation Post System on November 5 regarding an anomalous data access incident on an outsourced online service system .
On November 5, 2026, OpenSSH released version 10.
CVE-2026-19868 in SonicWall SonicOS SSLVPN can let a user holding valid credentials for another authentication method bypass SAML authentication, and possibly the MFA that SAML enforces .
The Japan Network Security Association (JNSA) announced on November 6 that its "Information Security Comprehension Test Service" suffered unauthorized third-party access, potentially exposing personal data for up to approximately 15,128 users .
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
QiAnXin XLab says it captured a suspicious script, cwpsrv_update.
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.