HighVulnerabilityActiveExploitedKEVPatch availableCVE-2026-123158· updated Nov 12
On November 5, 2026, OpenSSH released version 10.
11 results
On November 5, 2026, OpenSSH released version 10.
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
On 2026-11-06, TWCERT/CC reported two heap-based buffer overflow vulnerabilities in WatchGuard Fireware OS, tracked as CVE-2026-112709 and CVE-2026-112710 (CVSS 4.
On 2026-11-06, TWCERT/CC reported multiple high-risk vulnerabilities in HPE Networking AOS-10 and AOS-8, including authentication bypass, buffer overflow, SQL injection, command injection, and sensitive information disclosure .
On October 22, TWCERT/CC published TVN-202610006: New Type Information Co.
On October 22, the Administration for Cyber Security (ACS), MODA urged public and private sectors to accelerate patching: Node.
On October 20, TWCERT/CC published TVN-202610007: Asia Xuan Information's BA-Workflow contains three SQL injection vulnerabilities, each with a CVSS v4.
On October 20, TWCERT/CC published TVN-202610005: Kaifa Technology's WebITR contains an insecure deserialization vulnerability (CVSS v4.
On October 20, TWCERT/CC published TVN-202610004: ArmorX Global Technology's ArmorX Spam contains a local file inclusion vulnerability (CVE-2026-113402) and a command injection vulnerability (CVE-2026-113403), each with a CVSS v4.
On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.
According to iThome, on the evening of August 20, Addcn Technology (5287) issued a cybersecurity material announcement on the Market Observation Post System (MOPS) disclosing an abnormal website access incident .