CVEs published November 9 to November 15, 2026
2,589 CVEs were published Nov 9 to Nov 15, 2026, 125 of them critical. CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 2,589
- Critical
- 125
- Added to CISA KEV
- 10
- Busiest day
- Tue, Nov 10 (2,065)
- Quietest day
- Mon, Nov 9 (524)
- November 9, 2026524 CVEs · 29 critical
- November 10, 20262,065 CVEs · 96 critical
Added to CISA KEV 10
- CVE-2026-102895GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated…gpustack
- CVE-2026-116779FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commandssignalwire freeswitch
- CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass…OpenBSD OpenSSH
- CVE-2026-123218IBM Aspera Faspex Authorization BypassIBM Aspera Faspex
- CVE-2026-111560OS Command Injection in Barracuda AppliancesBarracuda Networks Barracuda Email Security Gateway · Ba… +4
- CVE-2026-111793Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.Openwave Messaging (Ireland) Limited Webtop Media Transcoder
- CVE-2026-116606Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security GatewayBarracuda Networks Barracuda Email Security Gateway
- CVE-2026-124194Microsoft Outlook Spoofing VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2026-125350Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-20320A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read…Cisco BroadWorks