Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105725 | high | 7.0 | No | Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-69446 | medium | 4.4 | No | Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | 2026-11-03 |
| CVE-2026-118527 | medium | 4.3 | Listed | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload... | 2026-11-03 |
| CVE-2026-109262 | high | 7.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocat... | 2026-11-03 |
| CVE-2026-109263 | high | 7.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when... | 2026-11-03 |
| CVE-2026-109264 | low | 3.7 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack.... | 2026-11-03 |
| CVE-2026-87361 | medium | 4.3 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is... | 2026-11-03 |
| CVE-2026-109265 | medium | 5.3 | No | ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due... | 2026-11-03 |
| CVE-2026-87360 | medium | 5.3 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are a... | 2026-11-03 |
| CVE-2026-87299 | medium | 6.1 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are a... | 2026-11-03 |
| CVE-2026-87298 | medium | 6.5 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are a... | 2026-11-03 |
| CVE-2026-77881 | medium | 5.5 | No | Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route t... | 2026-11-03 |
| CVE-2026-77880 | high | 7.8 | No | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change rout... | 2026-11-03 |
| CVE-2026-77878 | high | 7.8 | No | Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore rou... | 2026-11-03 |
| CVE-2026-77877 | high | 7.8 | No | Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the... | 2026-11-03 |
| CVE-2026-77876 | high | 8.8 | No | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel mo... | 2026-11-03 |
| CVE-2026-73696 | high | 8.1 | No | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flo... | 2026-11-03 |
| CVE-2026-61719 | high | 8.9 | No | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuar... | 2026-11-03 |
| CVE-2026-61654 | not reported | — | No | Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/proje... | 2026-11-03 |
| CVE-2026-38601 | not reported | — | No | A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect au... | 2026-11-03 |