CVE catalog
Published CVEs with severity, CVSS and CISA KEV status. For Windows we also carry the part most catalogs leave blank: the update that fixes it, and the build revision that carries the fix.
408,335 CVEs · 1,768 known exploited · 4,269 Windows CVEs with a fix we can name
Newest first.
| CVE | Severity | CVSS | Exploited | Fix | Published | Description |
|---|---|---|---|---|---|---|
| CVE-2026-122190 | Low | 2.4 | - | - | 2026-11-05 | A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely... |
| CVE-2026-69068 | - | - | - | - | 2026-11-05 | Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory. |
| CVE-2026-69066 | - | - | - | - | 2026-11-05 | Memory corruption in GPU driver due to improper validation of VMID reservation. |
| CVE-2026-69050 | - | - | - | - | 2026-11-05 | Out-of-bounds memory access in a device driver due to improper resource state tracking. |
| CVE-2026-69044 | - | - | - | - | 2026-11-05 | In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption. |
| CVE-2026-69043 | - | - | - | - | 2026-11-05 | In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption |
| CVE-2026-69025 | - | - | - | - | 2026-11-05 | In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service |
| CVE-2026-69006 | - | - | - | - | 2026-11-05 | Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption. |
| CVE-2026-69005 | - | - | - | - | 2026-11-05 | Integer overflow in NPU driver parameter processing due to insufficient bounds checking. |
| CVE-2026-69002 | - | - | - | - | 2026-11-05 | Incorrect authorization in Samsung framework services due to missing permission checks |
| CVE-2026-68994 | - | - | - | - | 2026-11-05 | A double free vulnerability in NPU driver due to improper pointer management (941) |
| CVE-2026-68993 | - | - | - | - | 2026-11-05 | A double free vulnerability in NPU driver due to improper pointer management (940) |
| CVE-2026-68991 | - | - | - | - | 2026-11-05 | In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition. |
| CVE-2026-68990 | - | - | - | - | 2026-11-05 | In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation. |
| CVE-2026-68985 | - | - | - | - | 2026-11-05 | In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service. |
| CVE-2026-68984 | - | - | - | - | 2026-11-05 | In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption. |
| CVE-2026-48186 | - | - | - | - | 2026-11-05 | Improper handling of messages before AS security activation can cause unexpected behavior |
| CVE-2026-48183 | - | - | - | - | 2026-11-05 | Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions |
| CVE-2026-48179 | - | - | - | - | 2026-11-05 | In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service |
| CVE-2026-48178 | - | - | - | - | 2026-11-05 | Out of bound access in PPC due to race condition in global variable access |
| CVE-2026-48176 | - | - | - | - | 2026-11-05 | A memory corruption vulnerability caused by improper validation of messages |
| CVE-2026-48175 | - | - | - | - | 2026-11-05 | Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. |
| CVE-2026-48174 | - | - | - | - | 2026-11-05 | In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition. |
| CVE-2026-48173 | - | - | - | - | 2026-11-05 | In the NAS message handler, improper validation of the length field in NAS message causes memory corruption |
| CVE-2026-35495 | - | - | - | - | 2026-11-05 | In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability |
| CVE-2026-35494 | - | - | - | - | 2026-11-05 | In the baseband, memory corruption during NAS packet processing can cause a denial of service. |
| CVE-2026-33972 | - | - | - | - | 2026-11-05 | In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation. |
| CVE-2026-33971 | - | - | - | - | 2026-11-05 | In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition. |
| CVE-2026-33969 | - | - | - | - | 2026-11-05 | In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service. |
| CVE-2026-33965 | - | - | - | - | 2026-11-05 | An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow. |
| CVE-2026-33958 | - | - | - | - | 2026-11-05 | Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition. |
| CVE-2026-122992 | - | - | - | - | 2026-11-05 | In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field. |
| CVE-2026-122323 | High | 7.5 | - | - | 2026-11-05 | Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayload... |
| CVE-2026-122322 | High | 7.5 | - | - | 2026-11-05 | Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompr... |
| CVE-2026-122321 | Critical | 9.1 | - | - | 2026-11-05 | Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a... |
| CVE-2026-122320 | High | 7.7 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim namespace's sensitive Co... |
| CVE-2026-122319 | High | 7.5 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disr... |
| CVE-2026-122318 | High | 7.7 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issue... |
| CVE-2026-122316 | High | 8.5 | - | - | 2026-11-05 | Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expre... |
| CVE-2026-122315 | High | 7.5 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-l... |
| CVE-2026-122314 | High | 7.5 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook... |
| CVE-2026-122313 | Critical | 9.9 | - | - | 2026-11-05 | Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant'... |
| CVE-2026-122312 | High | 7.7 | - | - | 2026-11-05 | Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/no... |
| CVE-2026-122311 | Critical | 9.9 | - | - | 2026-11-05 | Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the a... |
| CVE-2026-122310 | Critical | 9.9 | - | - | 2026-11-05 | Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's Service... |
| CVE-2026-122309 | Medium | 6.2 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over la... |
| CVE-2026-122308 | High | 8.5 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with crafted policy, rule, and... |
| CVE-2026-122307 | High | 7.7 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyException... |
| CVE-2026-122306 | High | 7.7 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing... |
| CVE-2026-122305 | High | 7.7 | - | - | 2026-11-05 | Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution... |
What the Fix column means
A KB means we hold Microsoft's own remediation data for that CVE: the update that fixes it and, where Microsoft publishes one, the build revision that carries the fix. That is the difference between knowing a CVE exists and knowing whether the machine in front of you is still exposed to it.
If you want that answered for a specific machine rather than a specific CVE, paste your build into the patch checker. It walks the supersedence chain, so it can tell you that the update you actually installed covers a fix that shipped in an earlier one.
Where the data comes from
CVE records, CVSS scores and descriptions come from NVD. The exploited flag comes from CISA's KEV catalog. Windows fix data comes from Microsoft's own security update feed. We are not endorsed by or certified by any of them.