critical Windows vulnerabilities

Critical Windows Kerberos, LDAP, DNS, DHCP and iSCSI Flaws Rated CVSS 9.8 Patched in November 2026

Do Son November 11, 2026

Five critical Windows vulnerabilities rated CVSS 9.8 hit Windows Kerberos, LDAP, DNS, DHCP and iSCSI. Patch domain controllers and servers first.

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-20320CVSS 7.5
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote...
CISA KEV📅 Added to KEV: Nov 10, 2026
CVE-2026-111793CVSS 4.3
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted....
CISA KEV📅 Added to KEV: Nov 10, 2026
CVE-2026-111560CVSS 8.6
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda...
CISA KEV📅 Added to KEV: Nov 10, 2026
CVE-2026-116606CVSS 9.3
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to...
CISA KEV📅 Added to KEV: Nov 10, 2026
CVE-2026-125350
Use after free in XML. Reported by anonymous on 2026-11-06. Google is aware that an exploit for CVE-2026-125350...
CISA KEV📅 Added to KEV: Nov 10, 2026
CVE-2026-124194CVSS 6.5
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to...
CISA KEV📅 Added to KEV: Nov 10, 2026
CVE-2026-123751CVSS 9.8
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not...
Watchtower Verified📅 Updated: Nov 9, 2026
CVE-2026-114713CVSS 8.6
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing...
Admin intel📅 Updated: Nov 9, 2026

CVE-2026-126537CVSS 9.1
The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file...
📅 Updated: Nov 11, 2026
CVE-2026-80095CVSS 9.0
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker...
📅 Updated: Nov 11, 2026
CVE-2026-123695CVSS 9.8
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API...
📅 Updated: Nov 11, 2026
CVE-2026-121497CVSS 9.8
The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat...
📅 Updated: Nov 11, 2026
CVE-2026-118740CVSS 9.1
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
📅 Updated: Nov 11, 2026
CVE-2026-115735CVSS 9.6
The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file...
📅 Updated: Nov 11, 2026
CVE-2026-115733CVSS 9.1
The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every...
📅 Updated: Nov 11, 2026
CVE-2026-115734CVSS 9.6
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it,...
📅 Updated: Nov 11, 2026