30 results
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .
SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.
Apple released iOS and iPadOS 27.
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
The Roundcube team released Webmail security updates 1.
IBM published a bulletin on Nov 7 saying Aspera Faspex 5.
On November 5, 2026, OpenSSH released version 10.
CVE-2026-19868 in SonicWall SonicOS SSLVPN can let a user holding valid credentials for another authentication method bypass SAML authentication, and possibly the MFA that SAML enforces .
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .
In FreeSWITCH 1.
On 2026-11-06, TWCERT/CC reported two heap-based buffer overflow vulnerabilities in WatchGuard Fireware OS, tracked as CVE-2026-112709 and CVE-2026-112710 (CVSS 4.
On 2026-11-06, TWCERT/CC reported multiple high-risk vulnerabilities in HPE Networking AOS-10 and AOS-8, including authentication bypass, buffer overflow, SQL injection, command injection, and sensitive information disclosure .
On October 22, TWCERT/CC published TVN-202610006: New Type Information Co.
On October 22, the Administration for Cyber Security (ACS), MODA urged public and private sectors to accelerate patching: Node.
On October 20, TWCERT/CC published TVN-202610007: Asia Xuan Information's BA-Workflow contains three SQL injection vulnerabilities, each with a CVSS v4.
On October 20, TWCERT/CC published TVN-202610005: Kaifa Technology's WebITR contains an insecure deserialization vulnerability (CVSS v4.