Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56985 | high | 8.4 | No | In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to local escalation of privilege with... | 2026-09-18 |
| CVE-2026-57012 | high | 8.4 | No | In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of p... | 2026-09-18 |
| CVE-2026-86585 | not reported | — | No | The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an a... | 2026-09-18 |
| CVE-2026-86474 | not reported | — | No | The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, a... | 2026-09-18 |
| CVE-2026-86443 | not reported | — | No | Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local... | 2026-09-18 |
| CVE-2026-85628 | not reported | — | No | Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS W... | 2026-09-18 |
| CVE-2026-81301 | not reported | — | No | Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller... | 2026-09-18 |
| CVE-2026-92838 | high | 7.8 | No | A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link li... | 2026-09-18 |
| CVE-2026-68491 | not reported | — | No | An insufficient check allowed for the overwrite of arbitrary files via a symlink. | 2026-09-18 |
| CVE-2026-88262 | not reported | — | No | Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1. | 2026-09-18 |
| CVE-2026-88261 | not reported | — | No | Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1. | 2026-09-18 |
| CVE-2026-88260 | not reported | — | No | Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzco... | 2026-09-18 |
| CVE-2026-68953 | medium | 6.5 | No | The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device i... | 2026-09-18 |
| CVE-2026-68950 | high | 8.8 | No | The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file... | 2026-09-18 |
| CVE-2026-68070 | high | 8.8 | No | The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received byt... | 2026-09-18 |
| CVE-2026-66890 | critical | 9.6 | No | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. | 2026-09-18 |
| CVE-2026-87020 | high | 8.1 | No | An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes a... | 2026-09-18 |
| CVE-2026-85083 | medium | 6.8 | No | The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device m... | 2026-09-18 |
| CVE-2026-82583 | high | 8.3 | No | NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector... | 2026-09-18 |
| CVE-2026-82578 | high | 7.5 | No | When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no... | 2026-09-18 |