Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-45689 | critical | 9.1 | No | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7... | 2026-11-03 |
| CVE-2026-45688 | critical | 9.1 | No | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7... | 2026-11-03 |
| CVE-2026-44939 | not reported | — | No | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through u... | 2026-11-03 |
| CVE-2026-44420 | high | 8.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow... | 2026-11-03 |
| CVE-2026-42533 | high | 8.1 | No | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the m... | 2026-11-03 |
| CVE-2026-44273 | medium | 4.4 | No | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker... | 2026-11-03 |
| CVE-2026-42895 | high | 7.5 | No | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to... | 2026-11-03 |
| CVE-2026-40369 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-39379 | high | 7.1 | No | GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent o... | 2026-11-03 |
| CVE-2026-32996 | not reported | — | No | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | 2026-11-03 |
| CVE-2026-35086 | medium | 6.5 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz:... | 2026-11-03 |
| CVE-2026-34046 | high | 8.8 | No | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backe... | 2026-11-03 |
| CVE-2026-30872 | critical | 9.8 | No | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stac... | 2026-11-03 |
| CVE-2026-35160 | medium | 5.0 | No | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command (... | 2026-11-03 |
| CVE-2026-28819 | medium | 5.4 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia... | 2026-11-03 |
| CVE-2026-27876 | critical | 9.1 | No | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is ena... | 2026-11-03 |
| CVE-2026-30871 | critical | 9.8 | No | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stac... | 2026-11-03 |
| CVE-2026-27688 | medium | 5.0 | No | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read... | 2026-11-03 |
| CVE-2026-29783 | high | 7.8 | No | The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash par... | 2026-11-03 |
| CVE-2026-27612 | medium | 6.1 | No | Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to... | 2026-11-03 |