Affected product(s): Product Affected versions PostgreSQL 18 Earlier than 18.7 (includes CVE-2026-116322, unique to this branch) PostgreSQL 17 Earlier than 17.12 PostgreSQL 16 Earlier than 16.16 PostgreSQL 15 Earlier than
Affected product(s): Product Affected versions Apex One (on-premises server, 2019 SP1) Affected; Critical Patch B20113 (PHP module 8.2.35). According to the vendor, it can be installed on SP1 build 11092
Affected product(s): Product Affected versions Fixed in Microsoft 365 Apps for Enterprise (32- and 64-bit) Earlier than the November update for the channel in use The November update for each
Affected product(s): Product Affected versions Fixed version NetScaler ADC and NetScaler Gateway 14.1 Earlier than 14.1-73.57 14.1-73.57 and later NetScaler ADC and NetScaler Gateway 13.1 Earlier than 13.1-64.39 13.1-64.39 and
First update: Nov 13, 2026 On Nov 12, 2026, public proofs of concept were published for CVE-2026-119618, the critical mod_http2 flaw this bulletin described on Nov 11. Researchers report that
Affected product(s): Product Affected versions Node.js 26.x Earlier than 26.13.1 (all 16 CVEs in this batch). Node.js 24.x Earlier than 24.22.3 (all 16 CVEs in this batch). Node.js 22.x Earlier
Affected product(s): Product Affected versions PAN-OS (firewalls) 12.2, 12.1, 11.2 and 11.1 earlier than the hotfixes in this batch; for CVE-2026-0331, 0330, 0329 and 0328 also 10.2. Advisories 0327, 0326
Affected product(s): Product Affected versions Fixed in Cisco Expressway-C and Expressway-E (virtual and appliance), only if they are clustered X15.5.3 and earlier X15.5.20 Cisco Expressway Series X14 and earlier, when
Affected product(s): Product Affected versions FortiClient Mac, Windows and Windows PAM Mac 7.4.0 through 7.4.7; Windows and Windows PAM 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14. The 8.0 branches and
Affected product(s): Product Affected versions Fixed in DSM 7.4 Earlier than 7.4.1-90080-1 7.4.1-90080-1 or later DSM 7.3 Earlier than 7.3.2-86009-5 7.3.2-86009-5 or later DSM 7.2.2 Earlier than 7.2.2-72806-10 7.2.2-72806-10 or
Affected product(s): CVE Affected versions Fixed in CVE-2026-123551 14.0.0 through 16.1.3 inclusive (before 14.0.0 there is no notifications WebSocket) 16.1.4 (Oct 22, 2026) CVE-2026-123549 All versions up to 16.1.3 inclusive,
Affected product(s): Product Affected versions Fixed in GitLab Community Edition and Enterprise Edition (self-managed) All versions from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4 19.3.8, 19.4.6, and
Affected product(s): Product Affected versions Fixed in MongoDB Server (replica set members, including shard and config server in a partitioned cluster) 4.4.x before 4.4.32; 5.0.x before 5.0.35; 6.0.x before 6.0.30;
First update: Nov 11, 2026 Proof-of-concept code has been published that demonstrates CVE-2026-126187. The code reproduces the case described by the vendor — responses that transport multiple typed arrays and
First update: Nov 12, 2026 Overnight from Nov 11 to Nov 12, 2026, two new sets of findings, named 4EverAble2Shell and Agent2Shell, were published publicly, with proofs of concept. Researchers
Affected product(s): Family Key updates Windows 11 and Windows 10 KB5132061 (24H2, 25H2 and 26H2; builds 26100.9974 / 26200.9974 / 26300.9974), KB5132059 (26H1), KB5131087 (23H2), KB5131096 (21H2 and 22H2) and
Affected product(s): Product Affected versions Contact Form 7 (WordPress plugin) 6.2, 6.2.1, 6.2.2 and 6.2.3 The fix for CVE-2026-114432 is in 6.2.4 (Oct 29, 2026); 6.2.5, which includes it, is
Affected product(s): Product Affected versions SAP NetWeaver AS ABAP (Internet Communication Manager) — CVE-2026-76964 KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 SAP Web Dispatcher — CVE-2026-89126 HDB
Affected product(s): Product Affected versions Barracuda Email Security Gateway (ESG) CVE-2026-116606 and CVE-2026-111560; 9.4.0.030 or later is recommended Load Balancer ADC Only CVE-2026-111560; all versions Web Application Firewall (WAF) Only
Affected product(s): Product Affected versions SonicOS Gen7 — TZ, NSa, NSsp, and NSv 7.3.3-7015 and earlier SonicOS Gen8 — TZ, NSa, and NSv 8.2.2-8015 and earlier This only applies if
Affected product(s): Product Affected versions Plex Media Server Earlier than 1.43.3.10861 (QNAP lists 1.43.2 and earlier) The vulnerabilities are in Plex Media Server, not in QTS or QuTS hero. They
Affected product(s): Product Affected versions SonicWall Global Management System (GMS), Windows and virtual appliance (Virtual Appliance) 9.5.2 and earlier There is no fixed version in the GMS 9.x branch: the
Affected product(s): Product Affected versions Microsoft Paint (Microsoft Store app) From 11.0.0.0 up to but not including 11.2609.401.0 The CVE record indicates that versions up to but not including 11.2605.91.0
Incomplete draft: the hosting firewall blocks pasting the full body via REST. Content ready in the local PDF bol-beacon-2026-143; do not publish as is.
Affected product(s): Product Affected versions Fixed version Cisco UCS Central Software 2.0 and earlier Migrate to a fixed version Cisco UCS Central Software 2.1 earlier than 2.1(2c) 2.1(2c) Affects UCS
Affected product(s): Product Affected versions FreeRDP Earlier than 3.32.2 FreeRDP proxy (freerdp-proxy) — CVE-2026-121952 ≤ 3.32.1, with the proxy enabled FreeRDP client with rdpgfx channel — CVE-2026-121953 ≤ 3.32.1, with
Affected product(s): Product Affected versions SolarWinds Dameware 2026.3 and all earlier versions The vendor does not specify which component of Dameware contains the vulnerabilities. Description Two vulnerabilities have been published
Affected product(s): Product Affected versions WordPress 7.1 7.1.0 to 7.1.3 WordPress 7.0 7.0.0 to 7.0.7 WordPress 6.9 6.9.0 to 6.9.10 WordPress 6.8 6.8.0 to 6.8.11 WordPress 4.7 to 6.7 All
Affected product(s): Product Affected versions Fixed version ManageEngine Password Manager Pro Build 13235 and earlier 13236 ManageEngine PAM360 Build 8600 and earlier 8601 ManageEngine SharePoint Manager Plus Builds earlier than
Affected product(s): Product Affected versions Fixed version SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) Prior to V4.3.4.1 with Node-RED installed V4.3.4.1 Devices without Node-RED installed are not affected. Description A critical severity vulnerability
