CVE catalog
Published CVEs with severity, CVSS and CISA KEV status. For Windows we also carry the part most catalogs leave blank: the update that fixes it, and the build revision that carries the fix.
408,335 CVEs · 1,768 known exploited · 4,269 Windows CVEs with a fix we can name
Newest first.
| CVE | Severity | CVSS | Exploited | Fix | Published | Description |
|---|---|---|---|---|---|---|
| CVE-2026-13271 | High | 8.1 | - | - | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XM... |
| CVE-2026-12550 | Medium | 5.4 | - | - | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection paramet... |
| CVE-2026-12538 | Medium | 5.4 | - | - | 2026-11-04 | IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields. |
| CVE-2026-12356 | High | 7.5 | - | - | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. |
| CVE-2026-122235 | Medium | 4.7 | - | - | 2026-11-04 | Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files lik... |
| CVE-2026-122234 | Medium | 4.7 | - | - | 2026-11-04 | jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the appli... |
| CVE-2026-122233 | Low | 3.7 | - | - | 2026-11-04 | FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by ea... |
| CVE-2026-122224 | High | 8.1 | - | - | 2026-11-04 | WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ o... |
| CVE-2026-122140 | Medium | 5.8 | - | - | 2026-11-04 | Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud me... |
| CVE-2026-122139 | Medium | 5.3 | - | - | 2026-11-04 | blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited,... |
| CVE-2026-122138 | Medium | 5.3 | - | - | 2026-11-04 | BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force password... |
| CVE-2026-122137 | Medium | 6.7 | - | - | 2026-11-04 | Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then... |
| CVE-2026-122136 | Medium | 4.4 | - | - | 2026-11-04 | Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so... |
| CVE-2026-122135 | High | 8.8 | - | - | 2026-11-04 | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute the attacker's program... |
| CVE-2026-122134 | High | 8.8 | - | - | 2026-11-04 | Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, invoking the filters... |
| CVE-2026-122133 | High | 8.8 | - | - | 2026-11-04 | Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before an... |
| CVE-2026-122132 | Medium | 6.1 | - | - | 2026-11-04 | go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resol... |
| CVE-2026-122131 | Low | 3.7 | - | - | 2026-11-04 | Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compile... |
| CVE-2026-122130 | High | 8.2 | - | - | 2026-11-04 | CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding ove... |
| CVE-2026-122129 | Medium | 5.3 | - | - | 2026-11-04 | CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 G... |
| CVE-2026-122127 | High | 7.5 | - | - | 2026-11-04 | CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector. |
| CVE-2026-122126 | Medium | 5.9 | - | - | 2026-11-04 | reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mRea... |
| CVE-2026-122014 | Medium | 6.3 | - | - | 2026-11-04 | A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2026-122013 | Critical | 10 | - | - | 2026-11-04 | A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit... |
| CVE-2026-122009 | High | 7.3 | - | - | 2026-11-04 | A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authorit... |
| CVE-2026-121969 | Medium | 6.5 | - | - | 2026-11-04 | netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlon... |
| CVE-2026-121968 | Medium | 6.5 | - | - | 2026-11-04 | Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or m... |
| CVE-2026-11724 | High | 8.5 | - | - | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during s... |
| CVE-2026-11376 | High | 8.8 | - | - | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscr... |
| CVE-2026-116376 | Low | 3.4 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability. |
| CVE-2026-115762 | Medium | 6.1 | - | - | 2026-11-04 | draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled att... |
| CVE-2026-115758 | - | - | - | - | 2026-11-04 | SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A networ... |
| CVE-2026-110283 | Medium | 4.3 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers. |
| CVE-2026-110282 | Medium | 6.5 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control. |
| CVE-2026-110281 | Medium | 5.9 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique. |
| CVE-2026-10859 | High | 7.5 | - | - | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads. |
| CVE-2026-108910 | Medium | 4.3 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step. |
| CVE-2026-108838 | Low | 3.3 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption. |
| CVE-2026-108767 | Medium | 4.3 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers. |
| CVE-2026-108588 | Medium | 5.4 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing. |
| CVE-2026-108536 | Medium | 4.6 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames. |
| CVE-2026-105991 | Low | 3.5 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header. |
| CVE-2026-105702 | Medium | 4.3 | - | - | 2026-11-04 | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details. |
| CVE-2026-104203 | High | 7.5 | - | - | 2026-11-04 | Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can ins... |
| CVE-2026-102664 | High | 7.1 | - | - | 2026-11-04 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authentic... |
| CVE-2026-102340 | High | 8.5 | - | - | 2026-11-04 | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateInterc... |
| CVE-2026-102339 | High | 8.2 | - | - | 2026-11-04 | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller ow... |
| CVE-2025-71457 | Critical | 9.8 | - | - | 2026-11-04 | vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrator... |
| CVE-2025-71456 | High | 8.1 | - | - | 2026-11-04 | vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over ot... |
| CVE-2025-71455 | Medium | 5.3 | - | - | 2026-11-04 | vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sess... |
What the Fix column means
A KB means we hold Microsoft's own remediation data for that CVE: the update that fixes it and, where Microsoft publishes one, the build revision that carries the fix. That is the difference between knowing a CVE exists and knowing whether the machine in front of you is still exposed to it.
If you want that answered for a specific machine rather than a specific CVE, paste your build into the patch checker. It walks the supersedence chain, so it can tell you that the update you actually installed covers a fix that shipped in an earlier one.
Where the data comes from
CVE records, CVSS scores and descriptions come from NVD. The exploited flag comes from CISA's KEV catalog. Windows fix data comes from Microsoft's own security update feed. We are not endorsed by or certified by any of them.