Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78663 | critical | 9.1 | No | The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a... | 2026-10-09 |
| CVE-2026-78660 | high | 7.5 | No | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HT... | 2026-10-09 |
| CVE-2026-107911 | high | 7.5 | No | A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authent... | 2026-10-09 |
| CVE-2026-107785 | not reported | — | No | Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of... | 2026-10-09 |
| CVE-2026-106581 | not reported | — | No | Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -packag... | 2026-10-09 |
| CVE-2026-104629 | high | 8.8 | No | A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to l... | 2026-10-09 |
| CVE-2026-107332 | medium | 5.5 | No | Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain Code... | 2026-10-09 |
| CVE-2026-104117 | not reported | — | No | A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IP... | 2026-10-09 |
| CVE-2026-104116 | not reported | — | No | A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in othe... | 2026-10-09 |
| CVE-2026-104114 | not reported | — | No | A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in... | 2026-10-09 |
| CVE-2026-104113 | not reported | — | No | A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door r... | 2026-10-09 |
| CVE-2026-104112 | not reported | — | No | A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door s... | 2026-10-09 |
| CVE-2026-101022 | medium | 4.3 | No | A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts m... | 2026-10-09 |
| CVE-2026-103220 | medium | 4.5 | No | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image dat... | 2026-10-09 |
| CVE-2026-101130 | low | 3.6 | No | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of string... | 2026-10-09 |
| CVE-2026-101094 | low | 3.6 | No | The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when par... | 2026-10-09 |
| CVE-2026-105673 | not reported | — | No | An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Ac... | 2026-10-09 |
| CVE-2026-20537 | medium | 6.7 | No | In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor... | 2026-10-09 |
| CVE-2026-108107 | critical | 9.8 | No | PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpo... | 2026-10-09 |
| CVE-2026-107828 | medium | 6.5 | No | Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts... | 2026-10-09 |