Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61495 | medium | 6.8 | No | TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_... | 2026-11-03 |
| CVE-2026-63197 | high | 7.3 | No | traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can... | 2026-11-03 |
| CVE-2026-61186 | critical | 9.4 | No | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version tha... | 2026-11-03 |
| CVE-2026-61169 | medium | 6.5 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6.... | 2026-11-03 |
| CVE-2026-60870 | high | 7.1 | No | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that a... | 2026-11-03 |
| CVE-2026-58547 | high | 7.8 | No | Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-58279 | medium | 6.5 | No | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 2026-11-03 |
| CVE-2026-56649 | high | 8.1 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unautho... | 2026-11-03 |
| CVE-2026-56178 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges loc... | 2026-11-03 |
| CVE-2026-55126 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att... | 2026-11-03 |
| CVE-2026-57156 | critical | 9.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overfl... | 2026-11-03 |
| CVE-2026-55186 | medium | 4.2 | No | Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged... | 2026-11-03 |
| CVE-2026-54161 | high | 8.1 | No | Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. F... | 2026-11-03 |
| CVE-2026-50573 | high | 8.1 | No | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detect... | 2026-11-03 |
| CVE-2026-52811 | not reported | — | No | Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the u... | 2026-11-03 |
| CVE-2026-52809 | medium | 6.8 | No | Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the... | 2026-11-03 |
| CVE-2026-52805 | high | 8.7 | No | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository... | 2026-11-03 |
| CVE-2026-52804 | not reported | — | No | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-leve... | 2026-11-03 |
| CVE-2026-54130 | high | 7.5 | No | Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 2026-11-03 |
| CVE-2026-50447 | critical | 9.8 | No | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | 2026-11-03 |