Zero-days, critical CVEs and patch alerts: actively exploited vulnerabilities, CISA KEV additions and fixed versions.
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.
On November 12, CISA published five industrial control system (ICS) advisories for Siemens products affected by two critical October flaws: Node2Shell in Node.js and PHP2Shell in PHP, both rated CVSS 9.8.
Two new attacks, Mior and Skyfall, let a malicious host read data from VMs protected by AMD SEV-SNP. The same week, Google Cloud told AMD Turin customers to patch three side-channel flaws.
Zoom released updates fixing two flaws in Zoom Workplace for Windows, including the critical `CVE-2026-108186` (CVSS 9.6), which could let an unauthenticated user escalate privileges over the network.
Node.js shipped updates fixing 16 vulnerabilities, seven rated high. The most notable lets an unauthenticated client crash HTTP/2 servers, and another can make a server send a client memory belonging to other connections.
PTC released a fix for a critical flaw in its Windchill and FlexPLM product lifecycle software, tracked as `CVE-2026-126325` (CVSS 9.2), that could allow remote code execution through crafted requests.
Red Hat fixed two critical flaws in its Quay container registry. The first, `CVE-2026-123710`, lets anyone who can reach the registry read and overwrite private images in every repository, with no account needed if anonymous access is on.
MongoDB fixed a critical flaw, `CVE-2026-118383` (CVSS 9.5), that lets an unauthenticated attacker send two requests that crash a database server if it is later elected primary while still behind on replication.
Git fixed `CVE-2026-111760`, a flaw that lets a malicious repository run attacker code on a machine that clones it recursively with submodules. The fix is in 2.56.1, with backports for the 2.50 to 2.55 series.
A researcher released SignDrop, a public exploit that claims a standard Windows user can escalate to SYSTEM through the CLFS driver. Microsoft has not confirmed the flaw, assigned a CVE or shipped a fix.
