Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-50377 | high | 7.8 | No | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-50354 | high | 7.1 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-50021 | high | 8.1 | No | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity fie... | 2026-11-03 |
| CVE-2026-50014 | high | 7.3 | No | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without... | 2026-11-03 |
| CVE-2026-49845 | critical | 9.8 | No | SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users... | 2026-11-03 |
| CVE-2026-47026 | high | 7.4 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions t... | 2026-11-03 |
| CVE-2026-47015 | high | 7.1 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). The supported version... | 2026-11-03 |
| CVE-2026-48946 | medium | 6.3 | No | The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and e... | 2026-11-03 |
| CVE-2026-49278 | medium | 6.7 | No | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8... | 2026-11-03 |
| CVE-2026-48613 | medium | 5.9 | No | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration,... | 2026-11-03 |
| CVE-2026-47009 | medium | 6.5 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that i... | 2026-11-03 |
| CVE-2026-45689 | critical | 9.1 | No | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7... | 2026-11-03 |
| CVE-2026-45688 | critical | 9.1 | No | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7... | 2026-11-03 |
| CVE-2026-44939 | not reported | — | No | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through u... | 2026-11-03 |
| CVE-2026-44420 | high | 8.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow... | 2026-11-03 |
| CVE-2026-42533 | high | 8.1 | No | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the m... | 2026-11-03 |
| CVE-2026-44273 | medium | 4.4 | No | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker... | 2026-11-03 |
| CVE-2026-42895 | high | 7.5 | No | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to... | 2026-11-03 |
| CVE-2026-40369 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-39379 | high | 7.1 | No | GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent o... | 2026-11-03 |