CVE-2026-1235628. Nov 2026
devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.
CVE-2026-1235598. Nov 2026
Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.
CVE-2026-1235558. Nov 2026
Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.
CVE-2026-1235288. Nov 2026
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.
CVE-2026-99284Debian Linux, Microsoft Azure Linux, Open Source Linux Kernel7. Nov 2026
kernel: kernel: privilege escalation via missing shared fragment flag in skb_zerocopy
CVE-2026-99283Debian Linux, Microsoft Azure Linux, Open Source Linux Kernel7. Nov 2026
kernel: kernel: Denial of Service via premature connection tracking expiration on TCP RST packets
CVE-2026-1243187. Nov 2026
Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.
CVE-2026-99281Debian Linux, Microsoft Azure Linux, Open Source Linux Kernel7. Nov 2026
kernel: kernel: Unauthorized network device access via missing permission checks on ownerless TUN/TAP devices
CVE-2026-99279Debian Linux, Microsoft Azure Linux, Open Source Linux Kernel7. Nov 2026
kernel: kernel: ksmbd: Denial of Service via unreclaimed expired sessions
CVE-2026-99272Debian Linux, Microsoft Azure Linux, Open Source Linux Kernel7. Nov 2026
kernel: kernel: out-of-bounds read in SMB client via crafted read response
CVE-2026-755907. Nov 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
CVE-2026-191217. Nov 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
CVE-2026-174117. Nov 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
CVE-2026-174077. Nov 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
CVE-2026-174067. Nov 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
CVE-2026-174057. Nov 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
CVE-2026-173977. Nov 2026
CVE-2026-173857. Nov 2026
CVE-2026-173827. Nov 2026
CVE-2026-173797. Nov 2026
CVE-2026-173577. Nov 2026
CVE-2026-173567. Nov 2026
CVE-2026-173267. Nov 2026
CVE-2026-173247. Nov 2026
CVE-2026-173097. Nov 2026
CVE-2026-17306Api Connect7. Nov 2026
CVE-2026-17294Api Connect7. Nov 2026
CVE-2026-17293Api Connect7. Nov 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.
CVE-2026-17290Api Connect7. Nov 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.
CVE-2026-17288Api Connect7. Nov 2026