Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-32996 | not reported | — | No | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | 2026-11-03 |
| CVE-2026-35086 | medium | 6.5 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz:... | 2026-11-03 |
| CVE-2026-34046 | high | 8.8 | No | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backe... | 2026-11-03 |
| CVE-2026-30872 | critical | 9.8 | No | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stac... | 2026-11-03 |
| CVE-2026-35160 | medium | 5.0 | No | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command (... | 2026-11-03 |
| CVE-2026-28819 | medium | 5.4 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia... | 2026-11-03 |
| CVE-2026-27876 | critical | 9.1 | No | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is ena... | 2026-11-03 |
| CVE-2026-30871 | critical | 9.8 | No | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stac... | 2026-11-03 |
| CVE-2026-27688 | medium | 5.0 | No | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read... | 2026-11-03 |
| CVE-2026-29783 | high | 7.8 | No | The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash par... | 2026-11-03 |
| CVE-2026-27612 | medium | 6.1 | No | Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to... | 2026-11-03 |
| CVE-2026-24317 | medium | 5.0 | No | SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could explo... | 2026-11-03 |
| CVE-2026-25941 | high | 8.1 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior t... | 2026-11-03 |
| CVE-2026-25929 | medium | 6.5 | No | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the documen... | 2026-11-03 |
| CVE-2026-20523 | high | 8.4 | No | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with... | 2026-11-03 |
| CVE-2026-18444 | high | 7.8 | No | There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This... | 2026-11-03 |
| CVE-2026-17024 | critical | 9.8 | No | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation... | 2026-11-03 |
| CVE-2026-13477 | high | 8.8 | No | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute ar... | 2026-11-03 |
| CVE-2026-15343 | not reported | — | No | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot u... | 2026-11-03 |
| CVE-2026-121736 | medium | 5.3 | No | NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unau... | 2026-11-03 |