Week 46, 2026
9 November to 15 November 2026, so far. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 12
- Critical
- 1
- High
- 0
- Added to KEV
- 0
Critical 1High 0Medium 11Low 0Not scored 0All 12 in the list
Most severe new CVEsBy CVSS score
- CVE-2026-119506
WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability
DynamiApps · Frontend Admin by DynamiApps
Critical9.1 - CVE-2026-124557
OtterMind Chat2DB Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass path traversal
OtterMind · Chat2DB
Medium6.9 - CVE-2026-124554
JeecgBoot JimuBI getAllChartData sql injection
JeecgBoot
Medium6.9 - CVE-2026-124509
floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal
floci-io · Floci
Medium6.9 - CVE-2026-124508
floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal
floci-io · Floci
Medium6.9 - CVE-2026-124507
conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery
conductor-oss · conductor
Medium6.9 - CVE-2026-124556
kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect
kekingcn · kkFileView
Medium5.3 - CVE-2026-124555
JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection
JeecgBoot
Medium5.3 - CVE-2026-124506
Dianping CAT Report hourlyReport.tag Model.getDomain cross site scripting
Dianping · CAT
Medium5.3 - CVE-2026-124505
Dianping CAT Login/Logout Handler.java Handler.redirect
Dianping · CAT
Medium5.3