CVE catalog
Published CVEs with severity, CVSS and CISA KEV status. For Windows we also carry the part most catalogs leave blank: the update that fixes it, and the build revision that carries the fix.
408,335 CVEs · 1,768 known exploited · 4,269 Windows CVEs with a fix we can name
Newest first.
| CVE | Severity | CVSS | Exploited | Fix | Published | Description |
|---|---|---|---|---|---|---|
| CVE-2026-119487 | Medium | 5.3 | - | - | 2026-11-03 | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2. |
| CVE-2026-119485 | Medium | 5.3 | - | - | 2026-11-03 | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2. |
| CVE-2026-116859 | Medium | 5.3 | - | - | 2026-11-03 | Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3. |
| CVE-2026-116858 | Medium | 4.3 | - | - | 2026-11-03 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3. |
| CVE-2026-115716 | Medium | 6.5 | - | - | 2026-11-03 | Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM... |
| CVE-2026-115715 | Medium | 6.5 | - | - | 2026-11-03 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an inde... |
| CVE-2026-115714 | High | 7.4 | - | - | 2026-11-03 | Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle;... |
| CVE-2026-115710 | Medium | 4.2 | - | - | 2026-11-03 | Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not... |
| CVE-2026-115298 | Medium | 4.3 | - | - | 2026-11-03 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some s... |
| CVE-2026-115297 | Medium | 6.5 | - | - | 2026-11-03 | NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A... |
| CVE-2026-115295 | Medium | 4.3 | - | - | 2026-11-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that... |
| CVE-2026-115294 | High | 7.3 | - | - | 2026-11-03 | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can... |
| CVE-2026-115293 | Medium | 6.5 | - | - | 2026-11-03 | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges... |
| CVE-2026-115292 | Medium | 4.3 | - | - | 2026-11-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame... |
| CVE-2026-115290 | High | 7.5 | - | - | 2026-11-03 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials ar... |
| CVE-2026-115289 | Medium | 4.3 | - | - | 2026-11-03 | Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A servi... |
| CVE-2026-114187 | Medium | 5.3 | - | - | 2026-11-03 | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0. |
| CVE-2026-114185 | Medium | 6.5 | - | - | 2026-11-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0. |
| CVE-2026-114183 | Medium | 6.5 | - | - | 2026-11-03 | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0. |
| CVE-2026-109594 | Medium | 6.8 | - | - | 2026-11-03 | Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in... |
| CVE-2026-109593 | Critical | 9.1 | - | - | 2026-11-03 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. |
| CVE-2026-103916 | - | - | - | - | 2026-11-03 | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with th... |
| CVE-2026-103077 | Medium | 4.3 | - | - | 2026-11-03 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. |
| CVE-2026-97350 | - | - | - | - | 2026-11-03 | Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: * Improper authorization of config... |
| CVE-2026-73328 | High | 7.2 | - | - | 2026-11-03 | Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user. |
| CVE-2026-65168 | High | 7 | - | - | 2026-11-03 | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code. |
| CVE-2026-65165 | Medium | 5.3 | - | - | 2026-11-03 | NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation. |
| CVE-2026-65140 | Medium | 5.7 | - | - | 2026-11-03 | NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator. |
| CVE-2026-65139 | Medium | 6.3 | - | - | 2026-11-03 | NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution. |
| CVE-2026-65138 | Medium | 6.3 | - | - | 2026-11-03 | NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys. |
| CVE-2026-65109 | Medium | 4.7 | - | - | 2026-11-03 | NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node. |
| CVE-2026-65108 | Medium | 6.3 | - | - | 2026-11-03 | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions. |
| CVE-2026-65107 | Medium | 6.3 | - | - | 2026-11-03 | NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to. |
| CVE-2026-121578 | Medium | 6.1 | - | - | 2026-11-03 | Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or c... |
| CVE-2026-121564 | - | - | - | - | 2026-11-03 | Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, becaus... |
| CVE-2026-121562 | Medium | 5.3 | - | - | 2026-11-03 | CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public v... |
| CVE-2026-121561 | High | 7.7 | - | - | 2026-11-03 | Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read... |
| CVE-2026-121560 | High | 7.1 | - | - | 2026-11-03 | LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, cont... |
| CVE-2026-121559 | High | 7.2 | - | - | 2026-11-03 | GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies eve... |
| CVE-2026-121558 | Medium | 4.3 | - | - | 2026-11-03 | AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/quer... |
| CVE-2026-121557 | Medium | 5.9 | - | - | 2026-11-03 | WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary... |
| CVE-2026-121556 | High | 8.3 | - | - | 2026-11-03 | FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite produ... |
| CVE-2026-121555 | High | 7.5 | - | - | 2026-11-03 | Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRu... |
| CVE-2026-121554 | Medium | 5.9 | - | - | 2026-11-03 | cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, na... |
| CVE-2026-121553 | Medium | 4.8 | - | - | 2026-11-03 | Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to... |
| CVE-2026-121552 | Medium | 4.3 | - | - | 2026-11-03 | Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner username... |
| CVE-2026-121551 | Medium | 5.4 | - | - | 2026-11-03 | PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated adm... |
| CVE-2026-121550 | Low | 3.3 | - | - | 2026-11-03 | nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-wr... |
| CVE-2026-121549 | Medium | 4.4 | - | - | 2026-11-03 | nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file th... |
| CVE-2026-121548 | High | 7.8 | - | - | 2026-11-03 | Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking toggl... |
What the Fix column means
A KB means we hold Microsoft's own remediation data for that CVE: the update that fixes it and, where Microsoft publishes one, the build revision that carries the fix. That is the difference between knowing a CVE exists and knowing whether the machine in front of you is still exposed to it.
If you want that answered for a specific machine rather than a specific CVE, paste your build into the patch checker. It walks the supersedence chain, so it can tell you that the update you actually installed covers a fix that shipped in an earlier one.
Where the data comes from
CVE records, CVSS scores and descriptions come from NVD. The exploited flag comes from CISA's KEV catalog. Windows fix data comes from Microsoft's own security update feed. We are not endorsed by or certified by any of them.