# CVEs > 5,605 CVEs, newest first: vulnerabilities mapped to SaaS vendors Rewindex tracks plus CISA Known Exploited Vulnerabilities, with CVSS, EPSS and linked status incidents. Canonical: https://rewindex.com/cves Last updated: 2026-10-24T00:31:30Z 5,605 CVEs match (1,756 in CISA KEV), newest first by published date (or KEV date added). Page 1. Query: `?company=&sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. | Published (UTC) | CVE | Title | CVSS | KEV | Companies | | --- | --- | --- | --- | --- | --- | | 2026-10-24 | [CVE-2026-115929](https://rewindex.com/cve/CVE-2026-115929.md) | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs | 6.8 medium | | MongoDB Atlas | | 2026-10-23 | [CVE-2026-115883](https://rewindex.com/cve/CVE-2026-115883.md) | LangGraph: Namespace labels containing \`.\` reach other namespaces in Postgres and SQLite stores | 6.0 medium | | LangChain (LangSmith) | | 2026-10-23 | [CVE-2026-115845](https://rewindex.com/cve/CVE-2026-115845.md) | Incomplete validation in the run\_script Python sandbox in AWS MCP Server | 6.4 medium | | Amazon Web Services | | 2026-10-23 | [CVE-2026-115813](https://rewindex.com/cve/CVE-2026-115813.md) | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server | 5.8 medium | | Amazon Web Services | | 2026-10-23 | [CVE-2026-115812](https://rewindex.com/cve/CVE-2026-115812.md) | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server | 9.8 critical | | Amazon Web Services | | 2026-10-23 | [CVE-2026-57845](https://rewindex.com/cve/CVE-2026-57845.md) | Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder | 8.8 high | | Hugging Face | | 2026-10-22 | [CVE-2026-114625](https://rewindex.com/cve/CVE-2026-114625.md) | Security Advisory 0199 | 9.9 critical | yes (2026-10-23) | | | 2026-10-14 | [CVE-2026-110447](https://rewindex.com/cve/CVE-2026-110447.md) | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | 9.2 critical | yes (2026-10-23) | | | 2026-10-23 | [CVE-2026-115547](https://rewindex.com/cve/CVE-2026-115547.md) | Command Execution via Admin Console Input in Okta Access Gateway | 9.1 critical | | Okta | | 2026-10-23 | [CVE-2026-115546](https://rewindex.com/cve/CVE-2026-115546.md) | Authentication Source Verification Issue in Okta Access Gateway | 8.1 high | | Okta | | 2026-10-22 | [CVE-2026-83938](https://rewindex.com/cve/CVE-2026-83938.md) | Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability | 10.0 critical | | Microsoft Azure | | 2026-10-22 | [CVE-2026-108456](https://rewindex.com/cve/CVE-2026-108456.md) | Azure AI Foundry Elevation of Privilege Vulnerability | 7.7 high | | Microsoft Azure | | 2026-10-22 | [CVE-2026-105014](https://rewindex.com/cve/CVE-2026-105014.md) | Azure Pipelines Remote Code Execution Vulnerability | 9.1 critical | | Microsoft Azure | | 2026-10-22 | [CVE-2026-115417](https://rewindex.com/cve/CVE-2026-115417.md) | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt | 7.5 high | | Amazon Web Services | | 2026-10-22 | [CVE-2026-115419](https://rewindex.com/cve/CVE-2026-115419.md) | Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server | 8.1 high | | Amazon Web Services | | 2026-10-22 | [CVE-2026-114655](https://rewindex.com/cve/CVE-2026-114655.md) | KMS request injection via unsanitized key vault and provider values in libmongocrypt | 5.9 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114654](https://rewindex.com/cve/CVE-2026-114654.md) | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards | 6.5 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114653](https://rewindex.com/cve/CVE-2026-114653.md) | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder | 6.5 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114652](https://rewindex.com/cve/CVE-2026-114652.md) | Update operator injection via single-element list rewriting in the update builder | 6.5 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114651](https://rewindex.com/cve/CVE-2026-114651.md) | Cross-document data leak via malformed BSON array parsing in reused thread buffer | 4.0 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114650](https://rewindex.com/cve/CVE-2026-114650.md) | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name | 5.9 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114649](https://rewindex.com/cve/CVE-2026-114649.md) | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache | 6.8 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114648](https://rewindex.com/cve/CVE-2026-114648.md) | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys | 7.6 high | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114647](https://rewindex.com/cve/CVE-2026-114647.md) | NoSQL operator injection via unvalidated replacement document in findOneAndReplace | 4.3 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114646](https://rewindex.com/cve/CVE-2026-114646.md) | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire | 6.5 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114645](https://rewindex.com/cve/CVE-2026-114645.md) | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping | 5.2 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114644](https://rewindex.com/cve/CVE-2026-114644.md) | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization | 5.9 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-114643](https://rewindex.com/cve/CVE-2026-114643.md) | Duplicate geometry fields via unvalidated GeoJSON extra members | 5.4 medium | | MongoDB Atlas | | 2026-10-22 | [CVE-2026-115414](https://rewindex.com/cve/CVE-2026-115414.md) | OS command injection in the Terraform hook in AWS SAM CLI | 7.8 high | | Amazon Web Services | | 2026-10-22 | [CVE-2026-54238](https://rewindex.com/cve/CVE-2026-54238.md) | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization | 3.1 low | | Supabase | | 2026-10-22 | [CVE-2026-115416](https://rewindex.com/cve/CVE-2026-115416.md) | Incorrect authorization checks in Amazon Athena engine version 3 query processing | 7.7 high | | Amazon Web Services | | 2026-10-22 | [CVE-2026-94482](https://rewindex.com/cve/CVE-2026-94482.md) | Next.js: Denial of Service in App Router using Server Actions | 8.2 high | | Vercel | | 2026-10-22 | [CVE-2026-111497](https://rewindex.com/cve/CVE-2026-111497.md) | Out-of-Bounds Write in Google Brotli Decoder | 9.2 critical | | | | 2026-10-22 | [CVE-2024-58394](https://rewindex.com/cve/CVE-2024-58394.md) | Retool 3.88.0 XSS via /api/imageProxy SVG Proxying | 6.1 medium | | Retool | | 2026-10-22 | [CVE-2026-13411](https://rewindex.com/cve/CVE-2026-13411.md) | Null condition in Playbooks import crashes the plugin | 4.3 medium | | Mattermost | | 2026-10-22 | [CVE-2026-93471](https://rewindex.com/cve/CVE-2026-93471.md) | Unbounded SAML message decompression in esaml allows memory exhaustion | 8.7 high | | Dropbox | | 2026-10-22 | [CVE-2026-86696](https://rewindex.com/cve/CVE-2026-86696.md) | Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion | 8.2 high | | Dropbox | | 2026-10-22 | [CVE-2026-105270](https://rewindex.com/cve/CVE-2026-105270.md) | Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | 8.7 high | | Dropbox | | 2026-10-22 | [CVE-2026-110264](https://rewindex.com/cve/CVE-2026-110264.md) | Integer Overflow or Wraparound in GitLab | 10.0 critical | | GitLab | | 2026-10-21 | [CVE-2026-12664](https://rewindex.com/cve/CVE-2026-12664.md) | Incorrect Authorization in GitLab | 6.8 medium | | GitLab | | 2026-10-21 | [CVE-2026-13319](https://rewindex.com/cve/CVE-2026-13319.md) | Authorization Bypass Through User-Controlled Key in GitLab | 4.3 medium | | GitLab | | 2026-10-21 | [CVE-2026-14288](https://rewindex.com/cve/CVE-2026-14288.md) | Use of Incorrectly-Resolved Name or Reference in GitLab | 3.1 low | | GitLab | | 2026-10-21 | [CVE-2026-15723](https://rewindex.com/cve/CVE-2026-15723.md) | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab | 8.2 high | | GitLab | | 2026-10-21 | [CVE-2026-16255](https://rewindex.com/cve/CVE-2026-16255.md) | Incorrect Authorization in GitLab | 5.9 medium | | GitLab | | 2026-10-21 | [CVE-2026-103515](https://rewindex.com/cve/CVE-2026-103515.md) | Incorrect Authorization in GitLab | 2.7 low | | GitLab | | 2026-10-21 | [CVE-2026-105711](https://rewindex.com/cve/CVE-2026-105711.md) | Use of Cache Containing Sensitive Information in GitLab | 3.5 low | | GitLab | | 2026-10-21 | [CVE-2026-105777](https://rewindex.com/cve/CVE-2026-105777.md) | Insertion of Sensitive Information Into Sent Data in GitLab | 4.3 medium | | GitLab | | 2026-10-21 | [CVE-2026-112378](https://rewindex.com/cve/CVE-2026-112378.md) | Use of Less Trusted Source in GitLab | 4.3 medium | | GitLab | | 2026-10-21 | [CVE-2026-112212](https://rewindex.com/cve/CVE-2026-112212.md) | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab | 7.5 high | | GitLab | | 2026-10-21 | [CVE-2026-112326](https://rewindex.com/cve/CVE-2026-112326.md) | Improper Cleanup on Thrown Exception in GitLab | 3.1 low | | GitLab | Next page: [page 2](https://rewindex.com/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 1 | 12 | 9 | 1 | 0 | 2 | | 2025-11-10 | 3 | 14 | 18 | 10 | 0 | 5 | | 2025-11-17 | 4 | 5 | 7 | 2 | 0 | 3 | | 2025-11-24 | 5 | 10 | 7 | 3 | 0 | 1 | | 2025-12-01 | 2 | 10 | 7 | 4 | 0 | 4 | | 2025-12-08 | 2 | 20 | 15 | 1 | 0 | 7 | | 2025-12-15 | 7 | 8 | 27 | 5 | 0 | 7 | | 2025-12-22 | 2 | 14 | 4 | 0 | 0 | 1 | | 2025-12-29 | 1 | 0 | 2 | 2 | 0 | 1 | | 2026-01-05 | 1 | 7 | 4 | 2 | 0 | 2 | | 2026-01-12 | 3 | 9 | 7 | 1 | 0 | 2 | | 2026-01-19 | 14 | 9 | 5 | 0 | 0 | 6 | | 2026-01-26 | 4 | 5 | 3 | 1 | 0 | 7 | | 2026-02-02 | 6 | 8 | 3 | 1 | 0 | 6 | | 2026-02-09 | 2 | 21 | 27 | 6 | 0 | 11 | | 2026-02-16 | 3 | 9 | 14 | 2 | 0 | 8 | | 2026-02-23 | 3 | 13 | 15 | 2 | 0 | 3 | | 2026-03-02 | 5 | 12 | 6 | 0 | 0 | 7 | | 2026-03-09 | 3 | 21 | 20 | 2 | 0 | 6 | | 2026-03-16 | 3 | 13 | 46 | 3 | 0 | 9 | | 2026-03-23 | 5 | 15 | 27 | 5 | 0 | 3 | | 2026-03-30 | 8 | 13 | 5 | 1 | 0 | 3 | | 2026-04-06 | 3 | 26 | 20 | 3 | 0 | 2 | | 2026-04-13 | 5 | 14 | 12 | 2 | 0 | 10 | | 2026-04-20 | 6 | 12 | 16 | 4 | 0 | 14 | | 2026-04-27 | 2 | 5 | 6 | 0 | 0 | 4 | | 2026-05-04 | 10 | 19 | 7 | 0 | 1 | 3 | | 2026-05-11 | 13 | 47 | 49 | 9 | 0 | 2 | | 2026-05-18 | 11 | 18 | 28 | 6 | 1 | 10 | | 2026-05-25 | 4 | 13 | 19 | 0 | 0 | 5 | | 2026-06-01 | 3 | 15 | 3 | 1 | 0 | 5 | | 2026-06-08 | 9 | 49 | 33 | 3 | 0 | 7 | | 2026-06-15 | 7 | 6 | 12 | 1 | 0 | 4 | | 2026-06-22 | 5 | 18 | 22 | 7 | 1 | 6 | | 2026-06-29 | 10 | 15 | 26 | 1 | 0 | 2 | | 2026-07-06 | 4 | 18 | 23 | 3 | 0 | 6 | | 2026-07-13 | 12 | 34 | 27 | 4 | 0 | 10 | | 2026-07-20 | 7 | 29 | 48 | 0 | 0 | 6 | | 2026-07-27 | 10 | 32 | 28 | 2 | 0 | 3 | | 2026-08-03 | 15 | 30 | 20 | 0 | 0 | 6 | | 2026-08-10 | 8 | 70 | 103 | 4 | 0 | 3 | | 2026-08-17 | 24 | 63 | 75 | 11 | 0 | 9 | | 2026-08-24 | 12 | 31 | 28 | 3 | 0 | 11 | | 2026-08-31 | 9 | 34 | 48 | 3 | 0 | 10 | | 2026-09-07 | 16 | 40 | 47 | 1 | 0 | 14 | | 2026-09-14 | 14 | 43 | 37 | 4 | 0 | 7 | | 2026-09-21 | 8 | 29 | 32 | 1 | 0 | 12 | | 2026-09-28 | 10 | 20 | 21 | 2 | 0 | 6 | | 2026-10-05 | 6 | 20 | 73 | 10 | 0 | 5 | | 2026-10-12 | 9 | 32 | 57 | 4 | 0 | 9 | | 2026-10-19 | 13 | 33 | 37 | 5 | 9 | 8 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/cves · Markdown: https://rewindex.com/cves.md · JSON: https://rewindex.com/api/v1/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:44:13.284Z