Daily summary
Vulnerabilities of 10 November 2026: 280 new, 22 critical, 1 newly exploited
280 vulnerabilities added on 10 November 2026, 22 critical and 148 high: Budibase (30), Microsoft SharePoint Server Subscription Edition (27), Adobe Experience Manager (13) and more. 1 vulnerability newly listed as exploited by CISA.
- 22 critical
- 148 high
- 79 medium
- 22 low
- 9 unrated
- 1 newly exploited
Newly listed as exploited
Added to CISA's Known Exploited Vulnerabilities catalog: attackers use it.
Budibase
30 vulnerabilities · Servers and applications · most fixed in 4.0.0
- 10.0Anonymous MongoDB filter erasure through dynamic __proto__ keys in PUBLIC query templates
- 9.9Prototype pollution in `GET /api/permission` (server permission controller `fetch`) leads to privilege escalation from app Builder to global Builder and…
- 9.9Broken Object-Level Authorization via attacker-controlled attachment key — cross-tenant file deletion (and conditional read) in the shared APPS object-store…
- 9.8Unverified-email OIDC/SSO account linking takes over password-less global Builder (isAccountLinkable allowlist omits builder)
- 9.1Unauthenticated automation execution at service privilege via User-Agent-conditional dev-workspace guard (POST /api/automations/:id/test)
Show 25 more
- CriticalAuthenticated RCE as root via unsandboxed require() of datasource plugin (incomplete fix of GHSA-gwr2-pgg3-p7xp)
- CriticalPublic API PUT /users/:userId lets any single-app Builder grant themselves an ADMIN role in any other workspace — incomplete fix of the role-assignment…
- 8.8Snowflake SQL injection via unparameterized query parameter interpolation
- 8.8Workspace-scoped builder can download, restore, rename, or delete another workspace's backups
- 8.8MongoDB operator injection via multi-object query templates
- 8.3Budibase string-templates FINALISE preprocessor bypass of noHelpers protection leads to Server-Side Template Injection (SSTI)
- 8.2Improper Neutralization of Special Elements Used in a Template Engine in @budibase/server
- 8.2Unauthenticated global-admin & database creation via tenant-confusion bypass of the one-time init guard (`POST /api/global/users/init`)
- 8.1Query injection in the ArangoDB and Snowflake datasources
- 8.1Budibase: Unauthenticated SQL Injection via Webhook to Snowflake EXECUTE_QUERY (isSQL Patch Bypass)
- 8.1Structural JSON injection in S3 delete / Google Sheets row query fields enables arbitrary S3 object deletion
- 8.1View row filters and hidden columns are not enforced on the /api/:viewId/rows* row routes: view users read, export, modify and delete the whole base table,…
- 7.7Cross-privilege Stored XSS in the Budibase Builder via broken HTML-escaping in `jsonFormatter.format()` rendered through `{@html}` in the CSP-less Builder…
- 7.6Server-Side Template Injection (SSTI) in Budibase row search via enrichSearchContext leading to arbitrary JavaScript execution
- 7.5Budibase Global Public Settings API Exposes Legacy LiteLLM Credentials to Unauthenticated Users
- 7.5MongoDB operator injection via published-app query templates survives the GHSA-8qv3-p479-cj62 fix (two-object update body)
- 7.2Non-admin users can read pending invite bearer codes and hijack invited identities via public invite/accept
- 7.1Amazon S3 object deletion injection via unparameterized delete-spec parameter interpolation
- 7.1Cross-Table IDOR in bulkDestroy Allows Arbitrary Workspace Document Deletion
- 7.1Workspace-scoped builder strips global builder/creator from any tenant user via public roles/assign appBuilder path
- 7.1Incomplete fix for CVE-2026-54356: getSignedUploadURL still mints presigned S3 PUTs for attacker-chosen key/bucket at the BASIC role
- HighBudibase: View Row-Filter Security Boundary Bypass via Single-Row Read and Attachment Endpoints
- HighMongoDB connectionString filesystem oracle — incomplete fix of GHSA-ppr4-5f46-j9c6
- HighScoped workspace creator can change tenant-wide environment variables in Budibase 3.48.0
- HighIncomplete fix of CVE-2026-35219: the outbound blacklist omits every IPv6 transition prefix, and setting `BLACKLIST_IPS` silently replaces the built-in defaults
Adobe Experience Manager
13 vulnerabilities · Servers and applications
- 9.9Adobe Experience Manager | Incorrect Authorization (CWE-863)
- 9.9Adobe Experience Manager | Incorrect Authorization (CWE-863)
- 9.9Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- 9.9Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- 5.4Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Show 8 more
- 5.4Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- 5.4Adobe Experience Manager | Improper Input Validation (CWE-20)
- 5.4Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- 5.4Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- 5.4Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- 5.4Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- 5.4Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- 5.4Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Microsoft SQL Server
52 vulnerabilities · Servers and applications · most fixed in 16.0.4315.2, 17.0.1155.3, 17.0.5045.3
- 9.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
Show 47 more
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8Microsoft SQL Server Remote Code Execution
- 8.8SQL Server Remote Code Execution
- 8.1Microsoft SQL Server Remote Code Execution
- 8.1Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 8.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.5Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.5Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.5Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.5Microsoft SQL Server Remote Code Execution
- 7.5Microsoft SQL Server Information Disclosure
- 7.5Microsoft SQL Server Remote Code Execution
- 7.5Microsoft SQL Server Remote Code Execution
- 7.5Microsoft SQL Server Remote Code Execution
- 7.5Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.5Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.5SQL Server Remote Code Execution
- 7.2Microsoft SQL Server Elevation of Privilege Vulnerability
- 7.2Microsoft SQL Server Remote Code Execution
- 7.2Microsoft SQL Server Remote Code Execution
- 7.0Microsoft SQL Server Elevation of Privilege Vulnerability
- 6.5Microsoft SQL Server Information Disclosure
- 6.5Microsoft SQL Server Information Disclosure
- 6.5Microsoft SQL Server Information Disclosure
- 6.5Microsoft SQL Server Information Disclosure
- 6.5Microsoft SQL Server Information Disclosure
- 6.5Microsoft SQL Server Information Disclosure
- 5.9Microsoft SQL Server Information Disclosure
- 5.7Microsoft SQL Server Information Disclosure
- 4.9Microsoft SQL Server Information Disclosure
Ruby on Rails
21 vulnerabilities · Servers and applications · most fixed in 8.0.5.2, 8.1.4.1
- 9.8Possible arbitrary file write and read in Active Storage image analysis
- 8.8Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
- 7.5Possible Strong Parameters bypass in Parameters#each_key in Action Pack
- 7.5Possible DoS vulnerability in Active Support safe_constantize
- 7.4Possible IP spoofing in Action Dispatch RemoteIp
Show 16 more
- 6.8Possible sensitive session information leak in Active Storage proxy mode
- 6.1Possible XSS vulnerability in Action View highlight helper
- 6.1Possible XSS vulnerability in Action View strip_tags
- 6.1Possible XSS vulnerability in Action View text helpers
- 5.9Possible DoS vulnerability in Action Controller Live streaming
- 5.3Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
- 5.3Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
- 4.8Possible cache poisoning in Action Pack content negotiation
- 4.7Possible XSS vulnerability in Action View tag helpers
- 4.7Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
- 4.7Possible XSS vulnerability in Active Support MessagePack serializer
- 4.3Possible DoS vulnerability in Active Storage filename handling
- 4.2Possible restoration of destroyed sessions in Action Dispatch CacheStore
- 3.7Possible signature replay in Action Mailbox Mailgun ingress
- 3.7Possible local file disclosure in Active Storage video previews and analysis
- 3.1Missing SameSite attribute on session cookies from Action Pack session stores
MongoDB
26 vulnerabilities · Servers and applications · most fixed in 8.0.37, 8.3.16, 9.0.7
- 9.5Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
- 9.1Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client
- 8.7Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage
- 8.7Post-authentication use-after-free in MongoDB Server time-series bucket validation
- 8.6Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access
Show 21 more
- 8.6Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access
- 8.2Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing
- 8.2Credential-handle retention via missing flag set in Windows Kerberos auth handler
- 7.5MultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root user
- 7.5Privilege escalation via fail-open user lookup in X.509 cluster-membership guard
- 7.1Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access
- 7.1Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access
- 7.1Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines
- 7.1Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure
- 7.1Post-authentication race condition in MongoDB Server geospatial schema validation
- 7.1Uncontrolled Resource Consumption in MongoDB Server Aggregation Framework via Internal Expression Leads to Denial of Service
- 7.1MongoDB SBE $locf Window Accumulator Use-After-Free Enables Heap OOB Read and Server Crash
- 7.0Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase
- 6.1Heap use-after-free read via yield-time state save in time-series block unpacking
- 6.0Full server crash via unbounded per-operand recursion in time-series query vectorization
- 6.0Use-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of Service
- 5.3Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator
- 5.3Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service
- 2.3Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data
- 2.3System collection contents readable through a database change stream with showSystemEvents
- 2.3Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path
OpenProject
11 vulnerabilities · Servers and applications · most fixed in 17.9.7
- 9.4Arbitrary zero-argument method invocation on visible projects via unvalidated attribute parameter in `InplaceEditFieldsController`
- 9.1Arbitrary zero-argument method invocation on visible work packages via the date picker `focused_field` parameter
- 8.3Arbitrary zero-argument method invocation on visible projects and work packages via attribute macros in exports and emails
- 6.8Second factor bypass through authentication stages kept in the session
- 6.5Anonymous password change endpoint has no per-account limit and works on normal accounts
Show 6 more
- 6.5Read-only repository members can push to Git repositories through a query string in the Smart HTTP URL
- 6.1Open redirect on /external_redirect without a session
- 4.3Work package activity shows the project phase to users without view_project_phases
- 4.3Relations filter returns relations of work packages the user cannot see
- 4.3Project activity feed discloses the display name of users outside the reader's visibility scope
- LowPOST /api/v3/storages: a normal non-admin user reaches constantize.new because the admin check runs after the object is built
.NET
22 vulnerabilities · Servers and applications · most fixed in 8.0.34, 10.0.15, 11.0.0
- 9.0ASP.NET Core Elevation of Privilege Vulnerability
- 8.8Visual Studio Remote Code Execution
- 8.8Visual Studio Remote Code Execution
- 8.8Visual Studio Remote Code Execution
- 8.8Visual Studio Remote Code Execution
Show 17 more
- 8.8Visual Studio Remote Code Execution
- 7.5ASP.NET Core Denial of Service Vulnerability
- 7.5ASP.NET Core Denial of Service Vulnerability
- 7.5ASP.NET Core Security Feature Bypass
- 7.5.NET Elevation of Privilege Vulnerability
- 7.5ASP.NET Core Denial of Service Vulnerability
- 7.5ASP.NET Core Denial of Service Vulnerability
- 7.5ASP.NET Core Denial of Service Vulnerability
- 7.5ASP.NET Core Elevation of Privilege Vulnerability
- 7.5ASP.NET Core Denial of Service Vulnerability
- 7.5.NET Denial of Service Vulnerability
- 7.5.NET Elevation of Privilege Vulnerability
- 6.8.NET Security Feature Bypass
- 6.5ASP.NET Core Security Feature Bypass
- 6.1ASP.NET Core Information Disclosure
- 5.9ASP.NET Core Information Disclosure
- 5.3.NET Denial of Service Vulnerability
Discourse
38 vulnerabilities · Servers and applications · most fixed in 2026.9.2, 2026.10.1, 2026.11.0-latest.1
- 8.9Backup restore follows symlinks in uploaded archives
- 8.8Admin takeover via user_api_keys
- 8.7Command injection in the uploads:gather rake task
- 8.7Path traversal in upload file paths from restored backups
- 8.3Cross-group authorization bypass in group inbox email replies
Show 33 more
- 8.2oauth2-basic callback paths call Ruby methods
- 7.7Two factor authentication bypass during account activation
- 7.6Privilege Escalation via Scoped API Keys Allowing External Identity Modification
- 7.5Denial of Service via Unbounded Search Terms
- 7.5Template injection in Automation placeholders lets any user become admin
- 7.1External upload stubs can reference files outside the temporary upload folder
- HighQuoteComparer skips Guardian: any user can read PMs via quote-modified
- 6.9Arbitrary file read via newlines in upload file names during S3 migration
- 6.9Secure uploads of other multisite sites can be signed
- 6.9Disk caches shared between multisite sites
- 6.9Path traversal in custom emoji export
- 6.5ReDoS in Markdown Image Size Parsing
- 6.5Unauthorized group membership via user field automation
- 6.3Race condition in email-code activation allows privilege escalation via address swap
- 5.5Path traversal in report CSV export
- 5.3Markdown root route leaks Latest topic list on login_required sites
- 5.3Restricted category Chat messages disclosed to readonly members via MessageBus
- 5.3Inactive account profiles disclosed through bulk user card lookup
- 5.3Discourse AI retries can access private content using another user's permissions
- 5.3Topic publishing lets non-staff users expose restricted topics and erase edit history
- 5.3Hidden post content may be exposed in RSS feeds, metadata, and digest emails
- 5.1HTML injection in oneboxes via external page metadata
- 5.1HTML injection in personal message notification emails via participant names
- 4.3Moving post can leak topic info
- 4.3Moderator can expose secure uploads via avatar settings
- MediumUnauthenticated DoS: integer user API public key triggers RSA key generation
- 3.1Hidden tag names disclosed through bulk topic actions
- 2.7Deleted whispers visible to moderators outside whisper-allowed groups
- 2.2Automation trigger endpoint allows forged event context to disclose private post content
- 2.1HTML injection in notification emails via iframe URLs and secure image sizes
- 2.1HTML injection via Unicode bidirectional characters in code blocks
- 2.1Censored watched words can inject HTML attributes into quoted chat messages
- 2.1Animated GIF detection reads files outside the store
Microsoft Exchange Server
9 vulnerabilities · Servers and applications · most fixed in 15.02.2562.057
Arbitrary file access in WordPress plugins
3 vulnerabilities
- 8.2Everest FormsUnauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
- 7.5Everest FormsUnauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
- 7.5Ultra Addons for Contact Form 7Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser
OpenSSL
5 vulnerabilities · Servers and applications · most fixed in 3.5.10, 4.0.4, 4.1.1
- –Out-of-Bounds Read and Incorrect IV Length Handling in AES-GCM-SIV
- –Retransmitted QUIC CRYPTO Frames Can Cause DoS or One-byte Disclosure
- –AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update
- –QUIC Uses Uninitialized Stack Bytes During Automated Peer Detection
- –Infinite Loop in CMS_encrypt() With an EC Group Order of 1
Linux kernel
4 vulnerabilities · Servers and applications · most fixed in 6.12.117, 6.18.63, 7.3.4
Secure Custom Fields
4 vulnerabilities · WordPress plugins · most fixed in 6.9.8
Broken access control in WordPress plugins
3 vulnerabilities
Other vulnerabilities in WordPress plugins
4 vulnerabilities
- 9.8Contact Form 7Contact Form 7: Unrestricted Upload of File with Dangerous Type
- 8.8WPIDE – File Manager & Code EditorCross Site Request Forgery (CSRF)
- 6.1Product Filter for WooCommerce by WBWReflected Cross-Site Scripting via 'text_no_products' Parameter
- 2.7Advanced Custom FieldsAdvanced Custom Fields (ACF®): Exposure of Sensitive Information to an Unauthorized Actor
Servers and applications
8 vulnerabilities
- 7.9Fortinet FortiSandboxA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,…
- 7.7Docker EngineCluster-API proxy overwrites forwarded client identity with its own
- 7.1Dolibarr ERP CRMDolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 IDOR via ExpenseReport Payment API
- 7.0Docker Engineiptables rules for overlay-network encryption are not reinstalled after a firewalld reload
- 6.5PodmanThe `podman auto-update` may restart arbitrary systemd units based from the image labels
Show 3 more
- 6.3Pythonimaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
- 5.9Fortinet FortiOSA improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via…
- 5.3PythonPrevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.