251 results
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .
ESET said on November 10 that it found a previously undocumented modular .
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
NEAR AI said in a November 9 incident report that an unauthorized party exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, ran code on one inference server, and then reached an internal system behind the deprecated Private Chat, downloading email addresses, names and some plan and balance details for about 100 users .
BleepingComputer reports that researcher Sean Bales publicly disclosed more than 30 N-able N-central vulnerabilities on Nov 8 without notifying the vendor and released proof-of-concept exploits in a GitHub repository called Able2Shell, the most critical chain using an unauthenticated XXE flaw to run commands on the server and create an admin account .
Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .
Ethersphere maintainers said on GitHub that Swarm Desktop 0.
Wiz says an attacker used IAM credentials from an AWS account associated with Qubole between Oct 14 and 26, 2026 to assume IAM roles that multiple customers had created to trust Qubole and enter their AWS environments .
The Record reports that German web hosting provider Mittwald CM Service disclosed in a Saturday blog post that hackers compromised 56 customer projects after going undetected on its systems for eight days .
Semiconductor packaging firm Xintec (3374) said in a Nov 6 MOPS filing that an unknown IP address intruded into its internal information systems .
On November 5, 2026, OpenSSH released version 10.
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .
According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .