CVE catalog
Published CVEs with severity, CVSS and CISA KEV status. For Windows we also carry the part most catalogs leave blank: the update that fixes it, and the build revision that carries the fix.
408,335 CVEs · 1,768 known exploited · 4,269 Windows CVEs with a fix we can name
Newest first.
| CVE | Severity | CVSS | Exploited | Fix | Published | Description |
|---|---|---|---|---|---|---|
| CVE-2026-121942 | Medium | 6.1 | - | - | 2026-11-04 | ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates... |
| CVE-2026-121941 | High | 7.8 | - | - | 2026-11-04 | libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, por... |
| CVE-2026-121940 | High | 8.8 | - | - | 2026-11-04 | Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-d... |
| CVE-2026-121939 | High | 8.1 | - | - | 2026-11-04 | Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including th... |
| CVE-2026-121938 | Medium | 5.3 | - | - | 2026-11-04 | langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership chec... |
| CVE-2026-121937 | Low | 3.1 | - | - | 2026-11-04 | loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comm... |
| CVE-2026-121936 | Medium | 6.5 | - | - | 2026-11-04 | easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in th... |
| CVE-2026-121620 | Medium | 6.5 | - | - | 2026-11-04 | CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* e... |
| CVE-2026-121373 | - | - | - | - | 2026-11-04 | The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony... |
| CVE-2026-121147 | - | - | - | - | 2026-11-04 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercep... |
| CVE-2026-121146 | - | - | - | - | 2026-11-04 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens. Successful expl... |
| CVE-2026-121145 | - | - | - | - | 2026-11-04 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of this vulnerability coul... |
| CVE-2026-121144 | - | - | - | - | 2026-11-04 | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedd... |
| CVE-2026-119481 | Critical | 9.8 | - | - | 2026-11-04 | Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1. |
| CVE-2026-119468 | High | 7.1 | - | - | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2. |
| CVE-2026-118516 | - | - | - | - | 2026-11-04 | The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that define a host, Compiled... |
| CVE-2026-118513 | - | - | - | - | 2026-11-04 | Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary... |
| CVE-2026-107479 | - | - | - | - | 2026-11-04 | An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash. |
| CVE-2026-97397 | High | 7.2 | - | - | 2026-11-04 | The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes i... |
| CVE-2026-59267 | High | 7.8 | - | - | 2026-11-04 | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-121925 | Medium | 6.6 | - | - | 2026-11-04 | A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's HTML response into a f... |
| CVE-2026-114456 | Medium | 6.5 | - | - | 2026-11-04 | Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary... |
| CVE-2026-104799 | High | 8.8 | - | - | 2026-11-04 | The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strp... |
| CVE-2026-90634 | High | 7.3 | - | - | 2026-11-04 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-90632 | Medium | 5.5 | - | - | 2026-11-04 | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are... |
| CVE-2026-90631 | Low | 3.3 | - | - | 2026-11-04 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOff... |
| CVE-2026-90629 | High | 7.3 | - | - | 2026-11-04 | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-90628 | High | 7.3 | - | - | 2026-11-04 | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-90627 | Medium | 5.5 | - | - | 2026-11-04 | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-90626 | High | 7.3 | - | - | 2026-11-04 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-90624 | High | 7.3 | - | - | 2026-11-04 | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-59268 | High | 7.3 | - | - | 2026-11-04 | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-59264 | High | 7.8 | - | - | 2026-11-04 | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-59263 | Medium | 5.5 | - | - | 2026-11-04 | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-115448 | - | - | - | - | 2026-11-04 | Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack... |
| CVE-2026-108946 | - | - | - | - | 2026-11-04 | Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another us... |
| CVE-2026-108500 | - | - | - | - | 2026-11-04 | Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL looku... |
| CVE-2026-103582 | - | - | - | - | 2026-11-04 | Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did... |
| CVE-2026-102704 | Medium | 4.4 | - | - | 2026-11-04 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally... |
| CVE-2026-102703 | Medium | 4.4 | - | - | 2026-11-04 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally... |
| CVE-2026-100302 | - | - | - | - | 2026-11-04 | Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the respons... |
| CVE-2026-100300 | - | - | - | - | 2026-11-04 | Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data... |
| CVE-2026-100252 | - | - | - | - | 2026-11-04 | Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to repl... |
| CVE-2026-100235 | - | - | - | - | 2026-11-04 | Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) a... |
| CVE-2026-95649 | - | - | - | - | 2026-11-04 | IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan. |
| CVE-2026-94460 | - | - | - | - | 2026-11-04 | IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality. |
| CVE-2026-94459 | - | - | - | - | 2026-11-04 | IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modifi... |
| CVE-2026-93900 | Medium | 6.4 | - | - | 2026-11-04 | The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the... |
| CVE-2026-120554 | High | 8.8 | - | - | 2026-11-04 | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_c... |
| CVE-2026-120422 | - | - | - | - | 2026-11-04 | Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious... |
What the Fix column means
A KB means we hold Microsoft's own remediation data for that CVE: the update that fixes it and, where Microsoft publishes one, the build revision that carries the fix. That is the difference between knowing a CVE exists and knowing whether the machine in front of you is still exposed to it.
If you want that answered for a specific machine rather than a specific CVE, paste your build into the patch checker. It walks the supersedence chain, so it can tell you that the update you actually installed covers a fix that shipped in an earlier one.
Where the data comes from
CVE records, CVSS scores and descriptions come from NVD. The exploited flag comes from CISA's KEV catalog. Windows fix data comes from Microsoft's own security update feed. We are not endorsed by or certified by any of them.