Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116044 | medium | 6.3 | No | A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of... | 2026-10-29 |
| CVE-2026-107058 | critical | 9.8 | No | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service... | 2026-10-29 |
| CVE-2026-107052 | high | 7.5 | No | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily r... | 2026-10-29 |
| CVE-2026-108494 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz | 2026-10-29 |
| CVE-2026-107047 | high | 7.5 | No | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanis... | 2026-10-29 |
| CVE-2026-107042 | high | 7.5 | No | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in a... | 2026-10-29 |
| CVE-2026-107015 | critical | 9.1 | No | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note dat... | 2026-10-29 |
| CVE-2026-103314 | high | 7.4 | No | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain u... | 2026-10-29 |
| CVE-2026-102559 | high | 8.6 | No | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByt... | 2026-10-29 |
| CVE-2026-102558 | high | 8.6 | No | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray bas... | 2026-10-29 |
| CVE-2026-102557 | high | 8.6 | No | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message... | 2026-10-29 |
| CVE-2026-102556 | high | 8.6 | No | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteA... | 2026-10-29 |
| CVE-2026-110076 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-110077 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-96108 | high | 7.8 | No | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-95943 | high | 7.0 | No | Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-83760 | medium | 5.5 | No | Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose information locally. | 2026-10-29 |
| CVE-2026-96206 | medium | 5.5 | No | Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally. | 2026-10-29 |
| CVE-2026-83741 | high | 7.8 | No | Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-83740 | high | 7.0 | No | Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | 2026-10-29 |