Latest news
Update MongoDB Server to 9.0.7 now to fix CVE-2026-118383, CVE-2026-120808, and 24 other flaws causing code execution, memory leaks, and crashes.
Five critical Windows vulnerabilities rated CVSS 9.8 hit Windows Kerberos, LDAP, DNS, DHCP and iSCSI. Patch domain controllers and servers first.
CISA KEV additions on November 10 cover six Known Exploited Vulnerabilities in Outlook, Chrome, Barracuda ESG, Cisco BroadWorks and Openwave.
Axis fixes 15 flaws, led by AXIS Camera Station bug CVE-2026-13312 (CVSS 9.9) that could compromise a system. AXIS OS updates also released.
Microsoft fixes a CVSS 9.9 SharePoint Server vulnerability, a 9.9 Azure DevOps Server RCE and a 9.8 SQL Server flaw in November 2026 Patch Tuesday.
Update to Git 2.56.1 now to fix six Git security vulnerabilities, including CVE-2026-111760 and CVE-2026-105437 for code execution and heap bugs.
Microsoft patches Outlook zero-day CVE-2026-124194, a spoofing flaw exploited in the wild and added to CISA KEV. Install the November 2026 updates.
Fortinet fixes eight critical vulnerabilities, including FortiManager RCE CVE-2026-126170 (CVSS 9.8). Fortinet critical vulnerabilities also hit FortiOS.
Update to version 30.0 now to fix three Bitcoin Core vulnerabilities, including CVE-2025-62861, CVE-2025-62860, and CVE-2025-62859 affecting nodes.
Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities, including an exploited Outlook zero-day, CVE-2026-124194, and a CVSS 10.0 Entra flaw.
Update self-managed servers to 19.5.4 now to fix the critical GitLab heap overflow flaw CVE-2026-105437 that allows command execution in Gitaly.
Update Synology DiskStation Manager now to patch CVE-2026-76954, CVE-2026-85101, and 25 other flaws allowing arbitrary file writes and crashes.
Zoom Workplace for Windows 7.1.8 fixes CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187, two escalation of privilege flaws. Update now.
Ivanti security advisories fix 13 flaws, including Ivanti Endpoint Manager RCE CVE-2026-121653 (CVSS 9.8) and CSA bug CVE-2026-121683.
Details and proof-of-concept steps for five mailcow vulnerabilities are public, including a CVSS 9.1 cross-tenant RCE. Update to 2026-11.
Composer 2.11.2 and 2.2.32 fix three Composer vulnerabilities, including command execution via a crafted composer.lock file (CVSS 8.8).
The November 2026 OpenSSL security advisory fixes five Low-severity bugs in OpenSSL QUIC, AES-GCM-SIV and CMS. Releases are due December 1.