Ivanti Patches 13 Vulnerabilities in Five Products, Including Two Critical Flaws
Ivanti has released security updates for five products, addressing a combined total of 13 vulnerabilities, including two rated as critical.
The company published its security advisories on November 10, 2026, covering Ivanti Endpoint Manager (EPM), Ivanti Cloud Services Application (CSA), Ivanti Sentry, Ivanti Endpoint Manager Mobile (EPMM), and Ivanti User Workspace Manager (UWM). Some vulnerabilities are shared across products, resulting in 13 unique CVE entries after deduplication.
In Ivanti EPM, two vulnerabilities were fixed. The flaw tracked as CVE-2026-121653 resides in the Core component and is an SQL injection issue that permits remote code execution without authentication. It received a CVSS v3.0 base score of 9.8 and is classified as critical.
Ivanti CSA received a patch for another critical vulnerability, CVE-2026-121683. This authentication bypass flaw allows an attacker to arbitrarily add or delete certificate registration information related to EPM Core. It carries a CVSS score of 9.4 and affects only version 5.0.8.
The remaining products received fixes for high-severity issues, although none reached the critical threshold. Ivanti has published separate advisories detailing the affected components and available mitigations for each product.
Related articles
Google Issues Second Chrome Update This Week, Patching 83 Vulnerabilities Including Five Critical Flaws
Google has released a new security update for its Chrome browser, marking the second release within the same week. The update addresses a total of 83 vulnerabilities across Windows, macOS, and Linux platforms. Five of these issues are rated Critical and involve Use After Free memory errors in key components such as ServiceWorker, CSS, Layout, Skia, and Accessibility. The previous update from November 9 fixed nine vulnerabilities, one of which (CVE-2026-125350) had already been observed in active exploitation. No evidence of in-the-wild exploitation has been reported for the latest set of fixes. The new versions are Chrome 157.0.8103.79 for Windows and macOS and 157.0.8103.78 for all three operating systems.
Mozilla Releases Firefox 160 Fixing 99 Vulnerabilities Including Multiple High-Severity Issues
Mozilla Foundation has published Firefox 160 along with its extended support release, addressing a total of 99 vulnerabilities. Although no Critical-rated flaws were present, 57 vulnerabilities received a High severity rating. Among the notable issues is a Use-After-Free flaw in CanvasWebGL (CVE-2026-124907) that could enable privilege escalation and sandbox bypass. A separate Use-After-Free vulnerability tied to inter-process communication (CVE-2026-124903) also carries the risk of sandbox escape. Additional patches resolve Same-Origin Policy bypasses tracked as CVE-2026-124874 and CVE-2026-124902, along with numerous other security problems across the browser.
Dart and Flutter SDKs Patch Critical TLS Flaw Tied to Compromised eMudhra Certificates
Dart and Flutter teams released updates to block compromised intermediate certificates from the eMudhra certificate authority. The flaw affects applications built for Android, Windows, and Linux that rely on dart:io for HTTPS connections. Stable releases include Dart 3.13.7 and Flutter 3.47.8, while beta channels received Dart 3.14.0-315.3.beta and Flutter 3.50.0-0.2.pre. The root cause traces to insufficient randomness during key generation for eight eMudhra intermediate CAs disclosed in October 2026. Because dart:io uses its own BoringSSL implementation rather than system revocation lists, applications must be rebuilt and redistributed to users. Additional changes improve root certificate handling on Android 14 and later via Conscrypt APEX modules.
Vulnerability Management Evolution: From Manual Scans to Continuous Threat Exposure Management
This final installment of the Vulnerability Management for Beginners series examines how the discipline has transformed over recent years into an essential component of organizational risk management. The article highlights the dramatic increase in disclosed vulnerabilities, now approaching 48,000 per year, and stresses that fewer than one percent pose real-world risk. It details the shift toward automated asset inventory integrated with SIEM, EDR, and CMDB systems, alongside multi-factor prioritization combining CVSS, EPSS, KEV lists, and FSTEC methodologies. New practices such as EASM, automated penetration testing, BAS, and CTEM are presented as extensions of a mature foundational process rather than replacements. The piece also covers regulatory tightening in Russia through FSTEC Order No. 117, mandatory remediation timelines, and the impact of AI on both defense and attack surfaces. It concludes with a practical Monday-morning action list focused on asset counting, threat feed integration, SLA definition, and cross-team coordination between IT and security.