Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118578 | medium | 4.3 | No | A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the comp... | 2026-10-28 |
| CVE-2026-118577 | medium | 6.3 | No | A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request For... | 2026-10-28 |
| CVE-2026-111575 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-28 |
| CVE-2026-111486 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-28 |
| CVE-2026-111478 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-28 |
| CVE-2026-93851 | high | 8.0 | No | Mattermost versions 11.9.x | 2026-10-28 |
| CVE-2026-83596 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | 2026-10-28 |
| CVE-2026-61575 | medium | 4.7 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filen... | 2026-10-28 |
| CVE-2026-61573 | medium | 6.1 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without o... | 2026-10-28 |
| CVE-2026-61572 | high | 8.6 | No | AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts c... | 2026-10-28 |
| CVE-2026-61571 | high | 7.3 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpo... | 2026-10-28 |
| CVE-2026-61569 | high | 7.5 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` paramet... | 2026-10-28 |
| CVE-2026-72694 | high | 7.1 | No | A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker... | 2026-10-28 |
| CVE-2026-78376 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result... | 2026-10-28 |
| CVE-2026-61567 | critical | 10.0 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named stream... | 2026-10-28 |
| CVE-2026-61564 | critical | 10.0 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `video... | 2026-10-28 |
| CVE-2026-61546 | not reported | — | No | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to ver... | 2026-10-28 |
| CVE-2026-57448 | not reported | — | No | Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET... | 2026-10-28 |
| CVE-2026-54455 | high | 7.6 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, ac... | 2026-10-28 |
| CVE-2026-54453 | high | 7.2 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, th... | 2026-10-28 |