Weekly Vulnerability Report: Nov 2 – Nov 8, 2026
50 new CVEs were published, 22 of them rated critical or high. 3 were added to CISA's exploited list.
Between November 2, 2026 and November 8, 2026, 50 new vulnerabilities were published, 92% more than the previous week (26). 22 of them, or 44%, were rated high or critical. The busiest day was November 2, 2026, with 15 CVEs.
CISA confirmed active exploitation of 3 vulnerabilities during the week. These are listed first below because attackers are already using them. WSO2 had the most new CVEs (12), and improper neutralization of input during web page generation was the most common weakness type (9).
Confirmed exploited this week
- 8.1 High severity
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Exploited
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the se
- 5.5 Medium severity
Apple Multiple Products Improper Authentication Exploited
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Poi
- 7.5 High severity
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Exploited
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor auth
The 15 most important new vulnerabilities
- 8.1 High severity
OpenBSD OpenSSH Unexpected Status Code or Return Value Exploited
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any p
- 9.8 Critical severity
IBM Aspera Faspex Incorrect Authorization Exploited
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
- 9.8 Critical severity
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Exploited
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modific
- 9.8 Critical severity
SignalWire FreeSwitch Code Injection Exploited
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of a
- 9.8 Critical severity
GPUStack Improper Authentication Exploited
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, whi
- 7.5 High severity
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Exploited
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor auth
- 7.2 High severity
Barracuda Networks Multiple Products OS Command Injection Exploited
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the craft
- 8.6 High severity
UnrealIRCd Improper Neutralization of Delimiters Exploited
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed
- 4.3 Medium severity
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- 8.4 High severity
Android: User Interface (UI) Misrepresentation of Critical Information
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for explo
- 8.4 High severity
Android: User Interface (UI) Misrepresentation of Critical Information
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed
- 9.8 Critical severity
vtenext: Unverified Password Change
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password t
- 9.4 Critical severity
WSO2 API Manager: Improper Authorization
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful ex
- 9.8 Critical severity
Ovation: Missing Authentication for Critical Functionality
Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.
- 8.8 High severity
Cloud Blocks: Improper Neutralization of Input During Web Page Generation
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an admi
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 7 | 14% |
| High | 15 | 30% |
| Medium | 23 | 46% |
| Low | 4 | 8% |
| Not yet scored | 1 | 2% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.