Source intelligence
425 collected source records. Original advisories and security research.
300 matching sources · Newest published first
Open CVE tracker →Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.
Scroll across the table to see all columns.
| Published | Finding / research | Publisher | Identifiers |
|---|---|---|---|
| Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previou… |
CyberScoop | ||
| Уязвимость SSHole уже взяли на вооружение хакеры ИБ-специалисты предупреждают, что злоумышленники уже применяют в реальных атаках новую уязвимость SSHole (также известную как *sshhole), которой присвоен идентификатор CVE-2026-123158. Баг возникает при взаимодействии Op… |
Xakep | ||
| PSIRT | FortiGuard Labs Summary An Improper Authentication vulnerability [CWE-287] in the FortiOS Remote Radius Type Admin Two-Factor (TFA) Authentication may allow a remote authenticated attacker with at least read-only permission to log in to… |
Fortinet | None reported |
|
| PSIRT | FortiGuard Labs Summary An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permi… |
Fortinet | None reported |
|
| Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. This Patch Tuesday addresses 66… |
BleepingComputer | ||
| PSIRT | FortiGuard Labs Summary An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacke… |
Fortinet | None reported |
|
| CVE-2026-14918 - AXIS Signed Video Framework Out-of-Bounds Read Vulnerability CVE-2026-14918 AXIS Signed Video Framework Out-of-Bounds Read Vulnerability Description The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using… |
CVE Feed | ||
| CVE-2026-9063 - Privilege Escalation via Insecure Configuration in Admin-Privileged Service CVE-2026-9063 Privilege Escalation via Insecure Configuration in Admin-Privileged Service Description A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized… |
CVE Feed | ||
| Google fixes the eighth actively exploited Chrome zero-day of 2026 Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported … |
Security Affairs | ||
| U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to … |
Security Affairs | ||
| CVE-2026-12389 - Remote Code Execution via Authenticated Arbitrary File Upload CVE-2026-12389 Remote Code Execution via Authenticated Arbitrary File Upload Description A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack. CVSS Scores Refe… |
CVE Feed | ||
| CVE-2026-8372 - Unauthorized Access Vulnerability in [Product Name] CVE-2026-8372 Unauthorized Access Vulnerability in [Product Name] Description A vulnerability that could allow an attacker to gain unauthorized access. CVSS Scores References to Advisories, Solutions, and Tools Here, you… |
CVE Feed | ||
| CVE-2026-63288 - API Authentication Bypass via WebSocket Request CVE-2026-63288 API Authentication Bypass via WebSocket Request Description A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authenticat… |
CVE Feed | ||
| CVE-2026-4762 - Server Privilege Escalation Vulnerability CVE-2026-4762 Server Privilege Escalation Vulnerability Description A vulnerability to perform a privilege escalation attack on the server as a non-admin user. CVSS Scores References to Advisories, Solutions, and Tools H… |
CVE Feed | ||
| CVE-2026-12964 - [Product/Vendor Name] Privilege Escalation Vulnerability CVE-2026-12964 [Product/Vendor Name] Privilege Escalation Vulnerability Description A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges. INFO Published Date : Nov. 10… |
CVE Feed | ||
| CVE-2026-12963 - Network Attached Storage Unauthorized Access Vulnerability CVE-2026-12963 Network Attached Storage Unauthorized Access Vulnerability Description A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server. INFO … |
CVE Feed | ||
| Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-116606 — Barracuda Networks / Barracuda Email Security Gateway (ESG). Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unau… |
CISA KEV | ||
| Barracuda Networks Multiple Products OS Command Injection Vulnerability CVE-2026-111560 — Barracuda Networks / Multiple Products. Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Appli… |
CISA KEV | ||
| Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability CVE-2026-20320 — Cisco / BroadWorks. Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration i… |
CISA KEV | ||
| Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability CVE-2026-111793 — Openwave Messaging Limited / Webtop Media Transcoder. Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authentic… |
CISA KEV | ||
| Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability CVE-2026-124194 — Microsoft / Office. Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. CISA… |
CISA KEV | ||
| Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses GHSA: GHSA-g3qx-frcg-j979 CVE: CVE-2026-88986 Reported severity: medium Advisory package entry 1: Affected package: github.com/kubeflow/pipelines (go) Affected versions: < 0.0.0-20251010122814-fedc25e3f725 Patched versio… |
GitHub Advisory Database | ||
| Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server GHSA: GHSA-r4mx-2gr2-8277 CVE: CVE-2026-88985 Reported severity: medium Advisory package entry 1: Affected package: github.com/kubeflow/pipelines (go) Affected versions: < 0.0.0-20260403210607-ac3a4c65677a Patched versio… |
GitHub Advisory Database | ||
| Kiwi TCMS account confirmation open redirect through protocol-relative URLs GHSA: GHSA-gcwf-c25f-p9rv CVE: CVE-2026-77433 Reported severity: medium Advisory package entry 1: Affected package: kiwitcms (pip) Affected versions: <= 12.4 Patched version: Not specified by advisory Advisory descriptio… |
GitHub Advisory Database |