CVE Tools
Track your stack

November 2026

181 CVEs so far, on pace for about 1,358. CISA has added 0 to KEV.

2026 month by month

2026, month by month. Point at another month to read it.
2026: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2026January 2026: 5,244 CVEs17 added to CISA KEVFebruary 2026: 4,931 CVEs28 added to CISA KEVMarch 2026: 6,821 CVEs26 added to CISA KEVApril 2026: 6,440 CVEs31 added to CISA KEVMay 2026: 7,365 CVEs21 added to CISA KEVJune 2026: 8,314 CVEs23 added to CISA KEVJuly 2026: 10,240 CVEs26 added to CISA KEVAugust 2026: 12,909 CVEs31 added to CISA KEVSeptember 2026: 15,180 CVEs43 added to CISA KEVOctober 2026: 17,650 CVEs36 added to CISA KEVNovember 2026 so far: 181 CVEs95,275+125%so far
Critical
2834% of the 82 with a CVSS score
Added to CISA KEV
0None of this month's own CVEs is in KEV yet
Vendors
3852 products
Top weakness
Out-of-bounds WriteCWE-787 · 21 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1Mediatek, Inc.Mediatek Chipset560nonenew
  2. 2GiteaGitea200nonenew
  3. 3Apache Software FoundationApache Wicket190nonenew
  4. 4WavlinkWN536AX6-A, WN553X1-B, WN701AE1918nonenew
  5. 5Ag-ui-protocolAg-ui50nonenew
  6. 6FfmpegFfmpeg50nonenew
  7. 7JovancodingNetwork-ai40nonenew
  8. 8Beam-cloudBETA9 Worker, BETA9 Gateway33nonenew
  9. 9OrayPugongying X5 Pro32nonenew
  10. 10CgohlkeImagecodecs20nonenew
  11. 11Deepset-aiFarm20nonenew
  12. 12HTTP4KHTTP4K20nonenew
  13. 13RuijieRg-es205gc, Rg-es206gc-p, Rg-es208gc20nonenew
  14. 14TheliaThelia Back-office Default Twig Template, Thelia, Thelia Core20nonenew
  15. 15VstarcamO-kam Superipcam, O-kam Client20nonenew
  16. 16AklivityZilla10nonenew
  17. 17BeecueFastbee10nonenew
  18. 18CrocoblockJetformbuilder10nonenew
  19. 19D-LinkDir-50511nonenew
  20. 20Hangzhou Xiongmai TechnologyP2papi.dll10nonenew
  21. 21Horizon DatasysReboot Restore Standard10nonenew
  22. 22JxxghpMoviepilot10nonenew
  23. 23LinksysE845011nonenew
  24. 24Liquid Web / StellarwpBookit11nonenew
  25. 25LobehubChat10nonenew

Severity

How this month's CVEs score on CVSS; 99 have no score yet. Severity is not exploitation.

  • Critical2834%
  • High1215%
  • Medium3543%
  • Low79%

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Ag-ui-protocol5#5
  2. Jovancoding4#7
  3. Beam-cloud3#8
  4. Oray3#9
  5. Cgohlke2#10
  6. Deepset-ai2#11
  7. HTTP4K2#12
  8. Thelia2#14
  9. Vstarcam2#15
  10. Aklivity1#16

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-787Out-of-bounds Write21new
  2. CWE-77Command Injection18new
  3. CWE-78OS Command Injection17new
  4. CWE-79XSS13new
  5. CWE-22Path Traversal12new
  6. CWE-862Missing Authorization11new
  7. CWE-200Information Exposure10new
  8. CWE-416Use After Free10new
  9. CWE-119Memory Buffer Bounds8new
  10. CWE-125Out-of-bounds Read8new
  11. CWE-1216new
  12. CWE-863Incorrect Authorization6new
  13. CWE-94Code Injection6new
  14. CWE-400Resource Consumption5new
  15. CWE-234new
  16. CWE-284Improper Access Control4new
  17. CWE-287Improper Authentication3new
  18. CWE-306Missing Auth for Critical Function3new
  19. CWE-4043new
  20. CWE-843Type Confusion3new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

In the news

The CVEs security news mentioned most in November 2026.

  1. CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder49.8
  2. CVE-2026-40217LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.48.8
  3. CVE-2026-98432ipv4: free inet_opt and ireq_opt after an RCU grace period49.8
  4. CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.38.6
  5. CVE-2026-110186Langflow OSS is affected by multiple vulnerabilities39.8
  6. CVE-2026-111357Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.37.0
  7. CVE-2026-118527Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known locati...34.3
  8. CVE-2026-58115A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authent...310.0
  9. CVE-2026-93680Langflow OSS is affected by multiple vulnerabilities39.8
  10. CVE-2024-10441Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-6...29.8
  11. CVE-2024-10445Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7...24.3
  12. CVE-2024-50629Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570...25.3

CVEs published in November 2026

5 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.

Snapshot v1, computed Nov 2, 2026, 05:00 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.