CVE-2026-127275 | NVD vulnerability record
NVD published this record on 2026-11-13 and last updated it on 2026-11-13.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
AL-TOUCH / SECURITY BRIEF
Security brief | 2026-11-13
Brand updates, public security notices and practical business actions, collected weekly.
This edition: major vulnerabilities and fixes
Critical · source ratingCVE-2026-127275 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingCVE-2026-120868 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingActive Storage: Possible arbitrary file write and read in image analysisVersions and remediation
GitHub Advisory Database · Source updated
Affected / fixed versions
- rubygems / activestorageAffected >= 8.1.0.beta1, < 8.1.4.1Fixed version 8.1.4.1
- rubygems / activestorageAffected < 8.0.5.2Fixed version 8.0.5.2
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
Match these source records to your assets; publication does not mean your systems are affected.
Compiled / adapted by AL-Touch · CC-BY-4.0
Critical · source ratingOpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)Versions and remediation
GitHub Advisory Database · Source updated
Affected / fixed versions
- maven / org.openmrs.web:openmrs-webAffected Not specified by the source; verification requiredFixed version Not specified; check the vendor advisory
- maven / org.openmrs.web:openmrs-webAffected >= 2.8.0,Fixed version Not specified; check the vendor advisory
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
Match these source records to your assets; publication does not mean your systems are affected.
Compiled / adapted by AL-Touch · CC-BY-4.0
Critical · source ratingCVE-2026-68548 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingCVE-2026-127063 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingCVE-2026-117551 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingMicrosoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass VulnerabilityVersions and remediation
GitHub Advisory Database · Source updated
Affected / fixed versions
- nuget / Aspire.Dashboard.Sdk.linux-x64Affected < 13.6.5Fixed version 13.6.5
- nuget / Aspire.Dashboard.Sdk.linux-arm64Affected < 13.6.5Fixed version 13.6.5
- nuget / Aspire.Dashboard.Sdk.linux-musl-x64Affected < 13.6.5Fixed version 13.6.5
- nuget / Aspire.Dashboard.Sdk.osx-x64Affected < 13.6.5Fixed version 13.6.5
- nuget / Aspire.Dashboard.Sdk.osx-arm64Affected < 13.6.5Fixed version 13.6.5
- nuget / Aspire.Dashboard.Sdk.win-x64Affected < 13.6.5Fixed version 13.6.5
- nuget / Aspire.Dashboard.Sdk.win-arm64Affected < 13.6.5Fixed version 13.6.5
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
Match these source records to your assets; publication does not mean your systems are affected.
Compiled / adapted by AL-Touch · CC-BY-4.0
Critical · source ratingCVE-2026-120869 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingCVE-2026-19422 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingCVE-2026-127046 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Critical · source ratingCVE-2026-127016 | NVD vulnerability recordVersions and remediation
NIST NVD · Source updated
Affected / fixed versions
Affected versions were not specified by the source. Check the vendor advisory before acting.
Remediation
Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.
NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
ISSUE 2026.11.13
A selection from approved public-source feeds over the previous seven days, with original links, dates and practical follow-up.
Read this edition ↓AL-TOUCH / WEEKLY EDITION
This edition: news and business action
Automatically selected records are compiled from their original sources, without independent confirmation of each item. Check vendor advice against your actual products, versions and deployment.
CVE-2026-120868 | NVD vulnerability record
NVD published this record on 2026-11-13 and last updated it on 2026-11-13.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Active Storage: Possible arbitrary file write and read in image analysis
GitHub Advisory Database lists GHSA-f3w6-w445-fwh9 for package activestorage, with affected range >= 8.1.0.beta1, < 8.1.4.1.
Business impact and suggested action
Compiled / adapted by AL-Touch · CC-BY-4.0
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
GitHub Advisory Database lists GHSA-78fc-9688-w8xw for package org.openmrs.web:openmrs-web.
Business impact and suggested action
Compiled / adapted by AL-Touch · CC-BY-4.0
CVE-2026-68548 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
CVE-2026-127063 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
CVE-2026-117551 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability
GitHub Advisory Database lists GHSA-4g86-54fm-h9h8 for package Aspire.Dashboard.Sdk.linux-x64, with affected range < 13.6.5.
Business impact and suggested action
Compiled / adapted by AL-Touch · CC-BY-4.0
CVE-2026-120869 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
CVE-2026-19422 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
CVE-2026-127046 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
CVE-2026-127016 | NVD vulnerability record
NVD published this record on 2026-11-12 and last updated it on 2026-11-12.
Business impact and suggested action
Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant
Sources, licences and permitted use
GovCERT.HK ↗ · Reference link / review required
HKCERT ↗ · Approved automatic source · CC-BY-3.0-HK
PCPD ↗ · Reference link / review required
Hong Kong Monetary Authority ↗ · Reference link / review required
Securities and Futures Commission ↗ · Reference link / review required
Hong Kong Police CyberDefender ↗ · Reference link / review required
CISA KEV ↗ · Approved automatic source · CC0-1.0
UK NCSC ↗ · Approved automatic source · Open Government Licence v3.0
Australian Cyber Security Centre ↗ · Reference link / review required
Singapore CSA / SingCERT ↗ · Reference link / review required
JPCERT/CC ↗ · Reference link / review required
CERT-EU ↗ · Reference link / review required
ANSSI / CERT-FR ↗ · Approved automatic source · Licence Ouverte / Open Licence v2.0
Canadian Centre for Cyber Security ↗ · Reference link / review required
New Zealand NCSC ↗ · Reference link / review required
CNCERT/CC ↗ · Reference link / review required
CERT-In ↗ · Reference link / review required
FBI / IC3 ↗ · Reference link / review required
NIST NVD ↗ · Approved automatic source · NIST non-SRD data public-service reuse grant
CVE Program ↗ · Reference link / review required
FIRST EPSS ↗ · Reference link / review required
CERT/CC ↗ · Reference link / review required
OWASP Foundation ↗ · Reference link / review required
GitHub Advisory Database ↗ · Approved automatic source · CC-BY-4.0
Microsoft MSRC ↗ · Reference link / review required
Google Cloud Security Bulletins ↗ · Approved automatic source · CC-BY-4.0
Apple Security Releases ↗ · Reference link / review required
Cisco PSIRT ↗ · Reference link / review required
Fortinet FortiGuard PSIRT ↗ · Reference link / review required
Palo Alto Networks PSIRT ↗ · Reference link / review required
Mozilla Security Advisories ↗ · Reference link / review required
Ivanti Security Advisory ↗ · Reference link / review required
Broadcom / VMware Security Advisories ↗ · Reference link / review required
Dell Security Advisories ↗ · Reference link / review required
HPE Security Bulletins ↗ · Reference link / review required
Lenovo Product Security ↗ · Reference link / review required
Oracle Security Alerts ↗ · Reference link / review required
Synology Security Advisories ↗ · Reference link / review required
Veeam Knowledge Base ↗ · Reference link / review required
WebRAY ↗ · Reference link / review required
Huorong Security ↗ · Reference link / review required
ToDesk ↗ · Reference link / review required
Adobe PSIRT ↗ · Reference link / review required
GlobalSign ↗ · Reference link / review required
xFusion PSIRT ↗ · Reference link / review required
Zenarmor Release Notes ↗ · Reference link / review required
The Hacker News ↗ · Reference link / review required
BleepingComputer ↗ · Reference link / review required
SecurityWeek ↗ · Reference link / review required
Hacker News community ↗ · Reference link / review required
Compiled by AL-Touch · each item links to its original source. This is the website edition; email delivery is arranged separately.