40 vulnerabilities across 15 products scored HIGH or above on November 05, 2026.

  • 🔴 CRITICAL: 3
  • 🟠 HIGH: 37

🔴 [CRITICAL] openemr/openemr

3 CVEs | CVSS 3.1: 9.6 | AAS 12.5

  • cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* (< 8.3.0)

OpenEMR versions prior to 8.4.0 are affected by three vulnerabilities, including at least one rated CRITICAL with a CVSS score of 9.6. The most severe issue involves improper access control in document management, where a low-privilege authenticated user can reassign arbitrary documents to different patients or categories without proper authorization checks, posing a serious risk to patient data confidentiality and integrity in healthcare environments.

Organizations running OpenEMR should prioritize upgrading to version 8.4.0 or later immediately. Healthcare IT and security teams should treat this as urgent given the critical severity, the exploitable nature of these flaws, and the sensitivity of electronic health records. The vendor has published a fix on GitHub, and administrators should review the referenced commit and apply all available patches without delay.

Vendor Advisory

🔴 [CRITICAL] immich-app/immich

1 CVE | CVSS 3.1: 8.8 | AAS 12.4

  • cpe:2.3:a:immich-app:immich:*:*:*:*:*:*:*:* (< 3.0.3)

Immich self-hosted photo and video management software prior to version 3.0.3 is affected by a critical vulnerability with a CVSS score of 8.8. An authenticated user with editor access to a shared album can exploit a privilege escalation flaw in album member role management to demote the album owner, seize ownership, remove the original owner, and ultimately delete the album and its contents.

Organizations and individuals running self-hosted Immich instances should upgrade to version 3.0.3 or later immediately. This is particularly relevant for deployments where albums are shared among multiple users, as any editor-level collaborator can exploit this flaw to take over and destroy shared photo libraries.

Vendor Advisory

🔴 [CRITICAL] signalwire/freeswitch

3 CVEs | CVSS 3.1: 9.8 | AAS 12.2

  • cpe:2.3:a:signalwire:freeswitch:*:*:*:*:*:*:*:*

FreeSWITCH versions prior to 1.11.3 are affected by three vulnerabilities, including at least one rated CRITICAL with a CVSS score of 9.8 and a public proof-of-concept available. The most severe issue allows a remote peer whose SIP MESSAGE is accepted to inject arbitrary FreeSWITCH API commands by manipulating the To header field, potentially enabling full system compromise of the telephony platform without additional authentication.

Organizations running FreeSWITCH in their VoIP or unified communications infrastructure should upgrade to version 1.11.3 or later as a priority. Given the critical severity, the existence of proof-of-concept exploit code, and the network-facing nature of SIP services, telecom and IT security teams should treat this as an urgent patching action and review SIP exposure controls in the interim.

Vendor Advisory

🟠 [HIGH] tinyhumansai/openhuman

6 CVEs | CVSS 3.1: 9.8 | AAS 11.6

  • cpe:2.3:a:tinyhumansai:openhuman:*:*:*:*:*:*:*:* (>= 0.53.15, < 0.57.5)

OpenHuman desktop application and Rust library versions prior to 0.57.13 are affected by six vulnerabilities, including multiple rated HIGH with a maximum CVSS score of 9.8. The most severe flaw allows an attacker who can send messages to a configured external channel to create persistent shell cron jobs without human approval, which then execute with the privileges of the OpenHuman runtime user, effectively enabling remote code execution through the agent’s own scheduling mechanism.

Anyone deploying OpenHuman as an AI agent harness should upgrade to version 0.57.13 or later immediately. Given the breadth of issues, the exploitable nature of the flaws, and the risk of persistent unauthorized command execution on host systems, security teams should audit any externally accessible OpenHuman instances and restrict channel access until patching is confirmed.

Vendor Advisory

🟠 [HIGH] apache_software_foundation/apache_ofbiz

6 CVEs | CVSS 3.1: 9.8 | AAS 11.4

  • cpe:2.3:a:apache:apache_ofbiz:*:*:*:*:*:*:*:* (>= 24.09, < 24.09.08)

Apache OFBiz version 24.09 prior to 24.09.08 is affected by six vulnerabilities, including multiple rated HIGH with a maximum CVSS score of 9.8. The most critical flaw is an authentication bypass in the ExternalLoginKeysManager, where a remote unauthenticated attacker who captures a live externalLoginKey value can obtain a complete, reusable session as the targeted user across all reachable webapps, bypassing both CSRF and authentication checks entirely.

Organizations running Apache OFBiz should upgrade to version 24.09.08 or later without delay. Given OFBiz’s role as an ERP and business automation platform handling sensitive operational data, and the exploitable nature of these flaws including unauthenticated remote access, security teams should treat this as a high-priority patching event and review access logs for any signs of session hijacking or unauthorized activity.

Vendor Advisory

🟠 [HIGH] bishopfox/sliver

1 CVE | CVSS 4.0: 8.2 | AAS 11.0

  • cpe:2.3:a:bishopfox:sliver:*:*:*:*:*:*:*:*

Sliver command and control framework versions prior to 1.7.6 are affected by a high-severity vulnerability with a CVSS score of 8.2 and a public proof-of-concept available. An unauthenticated attacker can exploit the HTTP(S) listener’s PNG encoder by brute-forcing the small nonce space and submitting a highly compressed image that expands during decoding, exhausting server memory and causing a denial-of-service condition against the C2 infrastructure.

Red teams and security operators running Sliver should upgrade to version 1.7.6 or later promptly. Since this flaw allows an external party to crash or degrade a Sliver teamserver without authentication, it poses a direct risk to ongoing operations, and teams should also consider restricting network exposure of listener endpoints until the patch is applied.

Vendor Advisory

🟠 [HIGH] apache_software_foundation/apache_juneau

1 CVE | CVSS 4.0: 10.0 | AAS 10.7

  • cpe:2.3:a:apache:apache_juneau:*:*:*:*:*:*:*:*

Apache Juneau versions through 9.2.0 are affected by a critical vulnerability with a maximum CVSS score of 10.0. The REST server’s default configuration accepts a “content” query parameter that replaces the request body on every HTTP method including GET, allowing an attacker to craft cross-site links that deliver arbitrary request bodies to endpoints without triggering a CORS preflight, effectively bypassing CSRF protections that rely on HTTP method or content type checks.

Organizations using Apache Juneau to build REST services should upgrade beyond version 9.2.0 immediately or disable the content query parameter as a mitigation. Given the perfect severity score and the ease of exploitation through simple cross-site links requiring no authentication, any application built on Juneau’s REST framework is potentially exposed to full CSRF attacks until patched.

Vendor Advisory

🟠 [HIGH] btcpay_server/btcpay_server

1 CVE | CVSS 4.0: 9.3 | AAS 10.5

  • cpe:2.3:a:btcpay_server:btcpay_server:*:*:*:*:*:*:*:* (< 2.4.2)

BTCPay Server versions prior to 2.4.2, including 2.4.2 release candidates, are affected by a high-severity information disclosure vulnerability with a CVSS score of 9.3. An unauthenticated remote attacker can retrieve LND Lightning Network Daemon macaroon credential files, which grant full administrative control over the Lightning node including the ability to move and steal funds from affected deployments.

Anyone operating BTCPay Server with a connected Lightning Network node should upgrade to version 2.4.2 stable or later immediately and rotate any potentially exposed macaroon credentials. Given that this flaw enables direct theft of cryptocurrency funds without any authentication, this should be treated as an emergency patching event, and operators should review node activity for unauthorized transactions.

Vendor Advisory

🟠 [HIGH] kubeflow/pipelines

1 CVE | CVSS 3.1: 9.6 | AAS 10.5

  • cpe:2.3:a:kubeflow:pipelines:*:*:*:*:*:*:*:* (< 2.18.0)

Kubeflow Pipelines versions prior to 2.18.0 are affected by a high-severity authorization bypass vulnerability with a CVSS score of 9.6. A low-privilege tenant can exploit the pipeline upload endpoints to skip Kubernetes SubjectAccessReview checks by omitting the target namespace, allowing them to create shared pipelines or inject attacker-controlled versions into existing pipelines used by other tenants in multi-user deployments.

Organizations running Kubeflow Pipelines in multi-tenant environments should upgrade to version 2.18.0 or later immediately. ML platform and Kubernetes security teams should treat this as urgent, as it enables supply-chain style attacks against machine learning workflows across tenant boundaries, and should audit existing shared pipelines for any unauthorized modifications.

Vendor Advisory

🟠 [HIGH] suitecrm/suitecrm

8 CVEs | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:* (< 7.15.2)
  • cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:* (>= 8.0.0, < 8.10.2)

SuiteCRM versions prior to 7.15.2 and 8.10.2 are affected by eight vulnerabilities, including multiple rated HIGH with a maximum CVSS score of 9.9. The most severe flaw allows an authenticated user with WorkFlow permissions to exploit a path traversal issue in the workflow controller’s require_once() call, enabling inclusion of attacker-controlled files and potentially leading to remote code execution on the CRM server.

Organizations using SuiteCRM should upgrade to version 7.15.2 or 8.10.2 or later without delay. Given the volume and severity of these issues, the exploitable nature of the flaws, and the sensitive customer data typically housed in CRM systems, security teams should prioritize this patch and review workflow module access controls and server logs for signs of exploitation.

Vendor Advisory

🟠 [HIGH] openbsd/openssh

1 CVE | CVSS 3.1: 8.1 | AAS 10.2

  • cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*

OpenSSH versions prior to 10.6p2 are affected by a high-severity authentication bypass vulnerability with a CVSS score of 8.1. On Linux systems using musl libc without PAM, such as Alpine Linux, the sshd daemon misinterprets password hash strings in a way that allows any password between 256 and 1024 characters to successfully authenticate against certain account configurations, effectively enabling unauthorized remote access.

Organizations running OpenSSH on musl-based Linux distributions, particularly Alpine Linux containers and hosts, should upgrade to OpenSSH 10.6p2 or later immediately. Given the widespread use of Alpine Linux in containerized environments, security teams should audit their container images and infrastructure for affected configurations and consider enabling PAM as an interim mitigation where immediate patching is not possible.

Vendor Advisory

🟠 [HIGH] kyverno/kyverno

5 CVEs | CVSS 4.0: 9.4 | AAS 9.7

  • cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:* (>= 1.17.0, < 1.19.2)
  • cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:* (>= 1.16.0, < 1.19.2)

Kyverno versions prior to 1.19.2 are affected by five vulnerabilities, including multiple rated HIGH with a maximum CVSS score of 9.4. The most critical flaw is a privilege escalation where namespace administrators can bypass their RBAC boundaries by creating policies with generate rules that the background controller executes using its own elevated permissions, enabling cluster-wide resource creation or cloning across namespaces and cluster-scoped kinds.

Kubernetes platform and security teams running Kyverno for policy enforcement should upgrade to version 1.19.2 or later immediately. These vulnerabilities undermine the fundamental tenant isolation that Kyverno is trusted to enforce, so teams should audit existing generate-rule policies for cross-namespace or cluster-scoped targets and review cluster resources for any unauthorized objects created through this vector.

Vendor Advisory

🟠 [HIGH] red_hat/red_hat_enterprise_linux_10

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:redhat:enterprise_linux:*:*:*:*:*:*:*:*

GDB as shipped in Red Hat Enterprise Linux 10 is affected by a high-severity stack buffer overflow vulnerability with a CVSS score of 8.8. A malicious or compromised debug target can exploit the remote protocol handler’s register reply parsing in fetch_register_using_p to overflow a stack-allocated buffer, enabling arbitrary code execution within the GDB client process of the developer or analyst connecting to it.

Development, security research, and incident response teams who use GDB for remote debugging should apply vendor patches from Red Hat as soon as they are available. This flaw is particularly dangerous in scenarios involving debugging of untrusted binaries, malware analysis, or connecting to remote debug stubs, and teams should avoid remote debugging against untrusted targets until the fix is confirmed in place.

Vendor Advisory

🟠 [HIGH] rucio/rucio

1 CVE | CVSS 3.1: 8.1 | AAS 9.2

  • cpe:2.3:a:rucio:rucio:*:*:*:*:*:*:*:*

Rucio scientific data management framework versions from 1.16.1 through 35.9.0, 38.6.0, and 41.0.0rc1 are affected by a high-severity privilege escalation vulnerability with a CVSS score of 8.1. Any authenticated low-privilege user can bypass the root-only permission check on the /credentials/signurl endpoint by spoofing the X-Rucio-Account header, obtaining presigned read, write, or delete URLs for arbitrary objects stored in S3, GCS, or Swift backends using the server’s own cloud credentials.

Research institutions and organizations running Rucio for scientific data management should upgrade to a patched version immediately. Given that this flaw grants any authenticated user unrestricted access to generate presigned URLs for any object in connected cloud storage, security teams should audit access logs for the signurl endpoint and review cloud storage activity for unauthorized data access or modification.

Vendor Advisory

🟠 [HIGH] iterm2/iterm2

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:* (< 3.7.7beta2)

iTerm2 versions prior to 3.7.7beta2 are affected by a high-severity argument injection vulnerability with a CVSS score of 8.7. An attacker can craft a malicious x-man-page URL that exploits percent-encoded NUL characters surviving input sanitization to inject arbitrary arguments into the /usr/bin/man command, enabling execution of attacker-controlled commands with the privileges of the logged-in macOS user simply by clicking a link.

macOS users and security teams managing developer workstations should upgrade iTerm2 to version 3.7.7beta2 or later as soon as possible. This is a click-to-compromise vulnerability that can be triggered through browsers, email clients, or any application that handles URL schemes, making it a practical social engineering vector against developers and system administrators who commonly use iTerm2.

Vendor Advisory