| CVE-2026-113971 | LOW | 3.5 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12… | 2026-11-09 |
| CVE-2026-114031 | HIGH | 7.8 | Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumi… | 2026-11-09 |
| CVE-2026-114032 | HIGH | 7.8 | The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulner… | 2026-11-09 |
| CVE-2026-115864 | NA | N/A | Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by e… | 2026-11-09 |
| CVE-2026-119759 | HIGH | 8.1 | TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authent… | 2026-11-09 |
| CVE-2026-122056 | MEDIUM | 5.9 | A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Exten… | 2026-11-09 |
| CVE-2026-123806 | MEDIUM | 4.0 | python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._… | 2026-11-09 |
| CVE-2026-123807 | CRITICAL | 9.8 | Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Sign… | 2026-11-09 |
| CVE-2026-123808 | MEDIUM | 5.3 | Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendere… | 2026-11-09 |
| CVE-2026-123809 | MEDIUM | 4.2 | Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_not… | 2026-11-09 |
| CVE-2026-123810 | MEDIUM | 4.3 | Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities i… | 2026-11-09 |
| CVE-2026-123811 | HIGH | 7.5 | Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the -… | 2026-11-09 |
| CVE-2026-123812 | LOW | 3.7 | Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebo… | 2026-11-09 |
| CVE-2026-123813 | HIGH | 7.5 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not … | 2026-11-09 |
| CVE-2026-123814 | MEDIUM | 6.4 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated… | 2026-11-09 |
| CVE-2026-123815 | NA | N/A | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extr… | 2026-11-09 |
| CVE-2026-123816 | HIGH | 8.1 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey… | 2026-11-09 |
| CVE-2026-123817 | NA | N/A | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket… | 2026-11-09 |
| CVE-2026-123818 | HIGH | 7.5 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0,… | 2026-11-09 |
| CVE-2026-123819 | MEDIUM | 6.5 | Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2,… | 2026-11-09 |
| CVE-2026-123820 | MEDIUM | 5.3 | Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2,… | 2026-11-09 |
| CVE-2026-124033 | MEDIUM | 6.4 | The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 co… | 2026-11-09 |
| CVE-2026-124992 | LOW | 3.3 | A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file cra… | 2026-11-09 |
| CVE-2026-124994 | MEDIUM | 6.3 | A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the functi… | 2026-11-09 |
| CVE-2026-124996 | MEDIUM | 6.3 | A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function ro… | 2026-11-09 |
| CVE-2026-124999 | MEDIUM | 6.3 | A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixi… | 2026-11-09 |
| CVE-2026-125105 | LOW | 3.7 | Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2,… | 2026-11-09 |
| CVE-2026-125106 | MEDIUM | 6.5 | Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2,… | 2026-11-09 |
| CVE-2026-125107 | HIGH | 7.5 | Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.… | 2026-11-09 |
| CVE-2026-125108 | LOW | 3.7 | Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse… | 2026-11-09 |
| CVE-2026-125109 | MEDIUM | 4.8 | Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #b… | 2026-11-09 |
| CVE-2026-125110 | MEDIUM | 5.3 | Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path af… | 2026-11-09 |
| CVE-2026-125111 | HIGH | 7.5 | Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can r… | 2026-11-09 |
| CVE-2026-125112 | NA | N/A | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.… | 2026-11-09 |
| CVE-2026-56712 | HIGH | 8.5 | Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cau… | 2026-11-09 |
| CVE-2026-61812 | NA | N/A | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.… | 2026-11-09 |
| CVE-2026-63496 | HIGH | 7.8 | augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep() function exported by @au… | 2026-11-09 |
| CVE-2026-63497 | NA | N/A | titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse … | 2026-11-09 |
| CVE-2026-63634 | NA | N/A | pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the f… | 2026-11-09 |
| CVE-2026-63644 | HIGH | 7.5 | bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary loc… | 2026-11-09 |
| CVE-2026-73857 | HIGH | 7.5 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.… | 2026-11-09 |
| CVE-2026-77473 | MEDIUM | 6.5 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 prot… | 2026-11-09 |
| CVE-2026-84410 | NA | N/A | In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker … | 2026-11-09 |
| CVE-2026-86692 | NA | N/A | In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash repo… | 2026-11-09 |
| CVE-2026-90585 | MEDIUM | 4.6 | The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sc… | 2026-11-09 |
| CVE-2026-90586 | HIGH | 7.8 | The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during … | 2026-11-09 |
| CVE-2026-90587 | MEDIUM | 4.6 | usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumCo… | 2026-11-09 |
| CVE-2026-90588 | LOW | 3.7 | The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_par… | 2026-11-09 |
| CVE-2026-90589 | MEDIUM | 5.5 | When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address sp… | 2026-11-09 |
| CVE-2026-90590 | MEDIUM | 6.5 | The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary se… | 2026-11-09 |