CVE catalog
Published CVEs with severity, CVSS and CISA KEV status. For Windows we also carry the part most catalogs leave blank: the update that fixes it, and the build revision that carries the fix.
408,335 CVEs · 1,768 known exploited · 4,269 Windows CVEs with a fix we can name
Newest first.
| CVE | Severity | CVSS | Exploited | Fix | Published | Description |
|---|---|---|---|---|---|---|
| CVE-2026-120642 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These... |
| CVE-2026-120641 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outs... |
| CVE-2026-120640 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields. CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from the query string, a form... |
| CVE-2026-120639 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipa... |
| CVE-2026-120638 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes... |
| CVE-2026-120637 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line ar... |
| CVE-2026-120636 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.exampl... |
| CVE-2026-120635 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values... |
| CVE-2026-120634 | - | - | - | - | 2026-11-04 | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or... |
| CVE-2026-120633 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirec... |
| CVE-2026-120632 | - | - | - | - | 2026-11-04 | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtr... |
| CVE-2026-120631 | - | - | - | - | 2026-11-04 | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the coo... |
| CVE-2026-118628 | High | 8.2 | - | - | 2026-11-04 | MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get-artifacts functi... |
| CVE-2026-118627 | High | 7.8 | - | - | 2026-11-04 | MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a... |
| CVE-2026-118626 | Medium | 5.4 | - | - | 2026-11-04 | MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of the BEFORE_REQUES... |
| CVE-2026-118625 | Medium | 6.3 | - | - | 2026-11-04 | MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_endpoints function. The issue results... |
| CVE-2026-118624 | Medium | 5.4 | - | - | 2026-11-04 | MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the _find_validator functio... |
| CVE-2026-118623 | High | 7.8 | - | - | 2026-11-04 | MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op... |
| CVE-2026-114552 | Medium | 6.5 | - | - | 2026-11-04 | MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The specific flaw exists within the impleme... |
| CVE-2026-114551 | Medium | 5.9 | - | - | 2026-11-04 | MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of mailbox credentials... |
| CVE-2026-114550 | High | 8.1 | - | - | 2026-11-04 | libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the... |
| CVE-2026-114549 | Critical | 9.8 | - | - | 2026-11-04 | NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens... |
| CVE-2026-121736 | Medium | 5.3 | - | - | 2026-11-03 | NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless author... |
| CVE-2026-121735 | Low | 3.7 | - | - | 2026-11-03 | blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup,... |
| CVE-2026-121734 | Medium | 6.5 | - | - | 2026-11-03 | ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull req... |
| CVE-2026-121733 | Medium | 5.4 | - | - | 2026-11-03 | Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing scri... |
| CVE-2026-121732 | Low | 2.7 | - | - | 2026-11-03 | RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request... |
| CVE-2026-121731 | High | 8.8 | - | - | 2026-11-03 | RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and stude... |
| CVE-2026-121730 | Medium | 6.5 | - | - | 2026-11-03 | emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organiza... |
| CVE-2026-121729 | High | 8.3 | - | - | 2026-11-03 | emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable i... |
| CVE-2026-121728 | Medium | 5.3 | - | - | 2026-11-03 | SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAc... |
| CVE-2026-121727 | High | 7.5 | - | - | 2026-11-03 | Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to... |
| CVE-2026-121582 | Medium | 6.5 | - | - | 2026-11-03 | A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public an... |
| CVE-2026-121581 | Medium | 4.3 | - | - | 2026-11-03 | A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has be... |
| CVE-2026-121565 | High | 7.4 | - | - | 2026-11-03 | Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys. |
| CVE-2026-121539 | Medium | 6.3 | - | - | 2026-11-03 | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the atta... |
| CVE-2026-121535 | Low | 3.7 | - | - | 2026-11-03 | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack rem... |
| CVE-2026-121520 | - | - | - | - | 2026-11-03 | In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the h... |
| CVE-2026-120775 | High | 7.2 | - | - | 2026-11-03 | Tanium addressed a heap-based buffer overflow vulnerability in Deploy. |
| CVE-2026-118237 | - | - | - | - | 2026-11-03 | An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algo... |
| CVE-2026-116669 | Medium | 6.5 | - | - | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Discover. |
| CVE-2026-116668 | Medium | 4.3 | - | - | 2026-11-03 | Tanium addressed an uncontrolled resource consumption vulnerability in Discover. |
| CVE-2026-116667 | Medium | 4.2 | - | - | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Discover. |
| CVE-2026-116666 | Medium | 4.3 | - | - | 2026-11-03 | Tanium addressed an information disclosure vulnerability in Discover. |
| CVE-2026-116665 | Medium | 4.3 | - | - | 2026-11-03 | Tanium addressed an information disclosure vulnerability in Discover. |
| CVE-2026-116664 | Low | 3.1 | - | - | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Discover. |
| CVE-2026-116663 | Medium | 6.5 | - | - | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Enforce. |
| CVE-2026-116661 | Medium | 6.5 | - | - | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Enforce. |
| CVE-2026-116654 | Medium | 6.5 | - | - | 2026-11-03 | Tanium addressed an improper input validation vulnerability in Threat Response. |
| CVE-2026-116653 | Medium | 4.3 | - | - | 2026-11-03 | Tanium addressed an improper input validation vulnerability in Threat Response. |
What the Fix column means
A KB means we hold Microsoft's own remediation data for that CVE: the update that fixes it and, where Microsoft publishes one, the build revision that carries the fix. That is the difference between knowing a CVE exists and knowing whether the machine in front of you is still exposed to it.
If you want that answered for a specific machine rather than a specific CVE, paste your build into the patch checker. It walks the supersedence chain, so it can tell you that the update you actually installed covers a fix that shipped in an earlier one.
Where the data comes from
CVE records, CVSS scores and descriptions come from NVD. The exploited flag comes from CISA's KEV catalog. Windows fix data comes from Microsoft's own security update feed. We are not endorsed by or certified by any of them.