← Vulnerabilities of the weekVulnerabilities of the week: November 2–8, 2026
The week’s top vulnerabilities: what they are and how they could harm you. Open an explanation to see who is affected and what to do.
#1 · CVE-2026-116779
attacks observed · public exploit on GitHub · KEV: attacks observed in the wild · CVSS 9.8 · EPSS: 2.5% chance of an attack attempt in the next 30 days
What this is
freeswitch can mistake part of an incoming message for an instruction to run commands. This can let the sender run their own program on the server.
How it can harm you
If freeswitch accepts the attacker's message, they can read settings and login details, control calls, and run commands with the program's permissions. An account that can sign in is sufficient; some affected configurations also allow access without a password.
Read the explanation →#2 · CVE-2026-123218
attacks observed · public exploit on GitHub · KEV: attacks observed in the wild · CVSS 9.8 · EPSS: 0.5% chance of an attack attempt in the next 30 days
What this is
IBM Aspera Faspex has a flaw in how it checks what users are allowed to do. A specially crafted message can give a user full administrator rights.
How it can harm you
A user with authorized access can gain full administrator rights in Aspera Faspex, potentially allowing them to read, change or delete data and disrupt the program. Whether signing in is required in every case is unclear.
Read the explanation →#3 · CVE-2026-102895
attacks observed · KEV: attacks observed in the wild · CVSS 9.8 · EPSS: 0.5% chance of an attack attempt in the next 30 days
What this is
gpustack manages graphics processors for running models and providing computing resources. It can mistake a request sent over the network for a local request and grant administrator access without checking who sent it.
How it can harm you
Someone who can reach gpustack over the network can gain administrator access without signing in if their request is mistaken for a local one and local identity checks are disabled, as they are by default. They can change users and models, create lasting administrator access keys, expose worker and cloud provider secrets, and run their own program on the server.
Read the explanation →#4 · CVE-2026-116606
attacks observed · public exploit on GitHub · Nuclei template · KEV: attacks observed in the wild · CVSS 9.3 · EPSS: 8.9% chance of an attack attempt in the next 30 days
What this is
Barracuda Email Security Gateway (ESG) has a flaw that lets an outsider bypass signing in and change the device’s overall settings.
How it can harm you
An attacker who can reach the device over a network can invoke its configuration import function without signing in. Restoring a specially prepared, compatible backup archive lets them change the device’s overall settings without permission or interaction from you.
Read the explanation →#5 · CVE-2026-111560
attacks observed · public exploit on GitHub · KEV: attacks observed in the wild · CVSS 8.6 · EPSS: 6.2% chance of an attack attempt in the next 30 days
What this is
Some appliances from Barracuda Networks incorrectly process the timezone setting. A specially crafted value can be treated as commands when the setting is later processed.
How it can harm you
Someone who can connect over a network and sign in as an administrator can insert commands into this setting. When it is processed, those commands run with unrestricted system privileges, allowing stored information to be read, changed or deleted and services to be stopped.
Read the explanation →#6 · CVE-2026-119977
attacks observed · public exploit on GitHub · KEV: attacks observed in the wild · CVSS 8.1 · EPSS: 1.2% chance of an attack attempt in the next 30 days
What this is
WordPress uses predictable temporary locations reachable over the Internet while updating its core from a complete package. This can let an attacker run their own program on the server during the update.
How it can harm you
An attacker can run their own program on your server without signing in while a full core update is underway. Successfully exploiting this requires difficult conditions; the precise timing and other requirements are not specified.
Read the explanation →#7 · CVE-2026-19868
attacks observed · public exploit on GitHub · KEV: attacks observed in the wild · CVSS 7.5 · EPSS: 0.5% chance of an attack attempt in the next 30 days
What this is
SonicOS may fail to enforce the required sign-in checks. Someone who can sign in through another authentication method may bypass those checks, including extra verification.
How it can harm you
Someone with valid sign-in details for another authentication method may gain access without completing the required checks. Exactly what they could then read or change is not specified.
Read the explanation →#8 · CVE-2024-27834
attacks observed · KEV: attacks observed in the wild · CVSS 5.5 · EPSS: 1.5% chance of an attack attempt in the next 30 days
What this is
Safari, iOS and iPadOS, macOS, tvOS and watchOS have a flaw in a security check. Someone who can already read and write arbitrary data may be able to bypass that protection.
How it can harm you
An attacker needs local access with limited privileges and the ability to read and write arbitrary data. They may bypass a security protection without any action from you. The specific changes this could allow are not described.
Read the explanation →#9 · CVE-2026-118527
attacks observed · KEV: attacks observed in the wild · CVSS 4.3 · EPSS: 0.8% chance of an attack attempt in the next 30 days
What this is
Ivanti Connect Secure uses predictable file names. This lets an attacker upload files containing content they choose to a known location on the server's disk.
How it can harm you
An attacker who can sign in and reach the program over a network can place files with their own content on disk. No action by another user is needed. The permissions needed to sign in are not specified.
Read the explanation →
Check your server for free →