Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-63434 | medium | 4.3 | No | MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitor... | 2026-11-03 |
| CVE-2026-63418 | high | 7.0 | No | Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supp... | 2026-11-03 |
| CVE-2026-64945 | high | 7.5 | No | A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show opera... | 2026-11-03 |
| CVE-2026-64944 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apa... | 2026-11-03 |
| CVE-2026-63694 | medium | 5.0 | No | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Com... | 2026-11-03 |
| CVE-2026-61511 | critical | 9.8 | No | vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method wi... | 2026-11-03 |
| CVE-2026-61325 | high | 7.6 | No | Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version tha... | 2026-11-03 |
| CVE-2026-61189 | medium | 6.5 | No | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version tha... | 2026-11-03 |
| CVE-2026-62196 | high | 8.3 | No | OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated send... | 2026-11-03 |
| CVE-2026-61495 | medium | 6.8 | No | TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_... | 2026-11-03 |
| CVE-2026-63197 | high | 7.3 | No | traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can... | 2026-11-03 |
| CVE-2026-61186 | critical | 9.4 | No | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version tha... | 2026-11-03 |
| CVE-2026-61169 | medium | 6.5 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6.... | 2026-11-03 |
| CVE-2026-60870 | high | 7.1 | No | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that a... | 2026-11-03 |
| CVE-2026-58547 | high | 7.8 | No | Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-58279 | medium | 6.5 | No | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 2026-11-03 |
| CVE-2026-56649 | high | 8.1 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unautho... | 2026-11-03 |
| CVE-2026-56178 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges loc... | 2026-11-03 |
| CVE-2026-55126 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att... | 2026-11-03 |
| CVE-2026-57156 | critical | 9.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overfl... | 2026-11-03 |