Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-48734 | high | 8.8 | No | Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to s... | 2026-11-03 |
| CVE-2025-25469 | high | 8.8 | No | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. | 2026-11-03 |
| CVE-2025-15381 | high | 7.1 | No | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permissi... | 2026-11-03 |
| CVE-2025-1094 | high | 8.1 | No | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQesc... | 2026-11-03 |
| CVE-2025-0107 | critical | 9.8 | No | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as t... | 2026-11-03 |
| CVE-2024-9121 | high | 8.8 | No | Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds me... | 2026-11-03 |
| CVE-2024-6671 | critical | 9.8 | No | In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability a... | 2026-11-03 |
| CVE-2024-6235 | high | 8.8 | No | Sensitive information disclosure in NetScaler Console | 2026-11-03 |
| CVE-2024-6409 | high | 7.0 | No | A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authentic... | 2026-11-03 |
| CVE-2024-55580 | high | 7.5 | No | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to... | 2026-11-03 |
| CVE-2024-55579 | high | 8.8 | No | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able t... | 2026-11-03 |
| CVE-2024-5805 | critical | 9.1 | No | Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gatew... | 2026-11-03 |
| CVE-2024-5907 | high | 7.0 | No | A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute prog... | 2026-11-03 |
| CVE-2024-5700 | high | 7.0 | No | Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corrupti... | 2026-11-03 |
| CVE-2024-54529 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An a... | 2026-11-03 |
| CVE-2024-53677 | critical | 9.8 | No | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums... | 2026-11-03 |
| CVE-2024-50379 | critical | 9.8 | No | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive f... | 2026-11-03 |
| CVE-2024-49541 | medium | 5.5 | No | Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensiti... | 2026-11-03 |
| CVE-2024-49368 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not v... | 2026-11-03 |
| CVE-2024-49114 | high | 7.8 | No | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 2026-11-03 |