Daily Brief

Tuesday, November 10, 2026

Added to KEV

4 additions

GPUStack

Authentication bypass letting an unauthenticated remote attacker act as administrator

Fix2.2.0 or laterFurther readingGPUStack advisory, further reading on GPUStack

IBM Aspera Faspex

Authorization flaw letting a signed-in user gain full administrative privileges

Fix5.0.19 PL1Further readingIBM advisory, further reading on IBM Aspera Faspex

OpenBSD OpenSSH

Authentication bypass letting remote attackers log in on musl-based Linux like Alpine

FixOpenSSH 10.6p2, or Alpine Linux’s updated packagesFurther readingOpenSSH release notes, further reading on OpenBSD OpenSSH Alpine Linux advisory, further reading on OpenBSD OpenSSH

SignalWire FreeSWITCH

Chat message flaw letting a remote peer run FreeSWITCH and system commands

Fix1.11.3 or laterFurther readingFreeSWITCH advisory, further reading on SignalWire FreeSWITCH

Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.11.09

Vulnerabilities and patches

4 items

Google Chrome

Exploited

Chrome memory flaw is exploited, Google says, and an update fixes it

Google hasn’t said what the use-after-free flaw lets attackers do or who used it, and the CVE record for it isn’t public yet.

Further readingGoogle release notes for Chrome 157 on desktop, further reading on Chrome memory flaw is exploited, Google says, and an update fixes it Microsoft release notes for Edge security, further reading on Chrome memory flaw is exploited, Google says, and an update fixes it

SAP Gateway, NetWeaver and Web Dispatcher

SAP fixes NetWeaver flaws that let attackers run code without signing in

Four of SAP’s 35 new notes fix flaws it rates 10.0, in the Internet Communication Manager, Web Dispatcher, Gateway and SAML sign-in, and no source reports attacks.

Further readingSAP advisory for November 2026, further reading on SAP fixes NetWeaver flaws that let attackers run code without signing in

Mongoose

MongoDB library Mongoose leaves document counts open to query injection

It affects apps that turn on sanitizeFilter and pass user input to countDocuments(), and Mongoose fixed it in 9.9.2, 8.24.3 and releases for the 6 and 7 lines.

Further readingMongoose advisory, further reading on MongoDB library Mongoose leaves document counts open to query injection

N-able N-central

Public exploit

N-able N-central flaws with public exploits let attackers run code on servers

N-able took hosted N-central offline on Nov 9, told on-premises customers to take their servers offline and expects a hotfix around midday Nov 10.

Further readingN-able notice, further reading on N-able N-central flaws with public exploits let attackers run code on servers Huntress research, further reading on N-able N-central flaws with public exploits let attackers run code on servers

Breaches and campaigns

1 item

Qubole

Attackers use data platform Qubole’s AWS access to steal secrets, Wiz says

Wiz says the attacks ran from Oct 14 to Oct 26, mostly through integration roles that were otherwise unused, and it lists the IP addresses and AWS user IDs.

Further readingWiz research, further reading on Attackers use data platform Qubole’s AWS access to steal secrets, Wiz says

Coming up

2 items

GitHub Enterprise Server

GitHub Enterprise Server 3.19 reaches end of support on Dec 9

GitHub supports at least the four newest feature releases, and its newest, 3.22, stays supported until Sep 8, 2027.

Further readingGitHub support dates, further reading on GitHub Enterprise Server 3.19 reaches end of support on Dec 9

Drupal

Drupal 10 reaches end of support on Dec 9, the week Drupal 12 is due

Drupal will make no new Drupal 10 releases after that date, and 10.6.0 is the last minor release of Drupal 10.

Further readingDrupal support dates, further reading on Drupal 10 reaches end of support on Dec 9, the week Drupal 12 is due

Worth reading