Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-5805 | critical | 9.1 | No | Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gatew... | 2026-11-03 |
| CVE-2024-5907 | high | 7.0 | No | A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute prog... | 2026-11-03 |
| CVE-2024-5700 | high | 7.0 | No | Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corrupti... | 2026-11-03 |
| CVE-2024-54529 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An a... | 2026-11-03 |
| CVE-2024-53677 | critical | 9.8 | No | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums... | 2026-11-03 |
| CVE-2024-50379 | critical | 9.8 | No | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive f... | 2026-11-03 |
| CVE-2024-49541 | medium | 5.5 | No | Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensiti... | 2026-11-03 |
| CVE-2024-49368 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not v... | 2026-11-03 |
| CVE-2024-49114 | high | 7.8 | No | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 2026-11-03 |
| CVE-2024-49113 | high | 7.5 | No | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | 2026-11-03 |
| CVE-2024-49112 | critical | 9.8 | No | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2026-11-03 |
| CVE-2024-49068 | high | 8.2 | No | Microsoft SharePoint Elevation of Privilege Vulnerability | 2026-11-03 |
| CVE-2024-49065 | medium | 5.5 | No | Microsoft Office Remote Code Execution Vulnerability | 2026-11-03 |
| CVE-2024-47606 | critical | 9.8 | No | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_... | 2026-11-03 |
| CVE-2024-45717 | medium | 4.8 | No | The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. T... | 2026-11-03 |
| CVE-2024-49019 | high | 7.8 | No | Active Directory Certificate Services Elevation of Privilege Vulnerability | 2026-11-03 |
| CVE-2024-46852 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONT... | 2026-11-03 |
| CVE-2024-43598 | high | 8.1 | No | LightGBM Remote Code Execution Vulnerability | 2026-11-03 |
| CVE-2024-3912 | critical | 9.8 | No | Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerab... | 2026-11-03 |
| CVE-2024-39877 | high | 8.8 | No | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a... | 2026-11-03 |