Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83784 | high | 8.8 | No | Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network. | 2026-10-29 |
| CVE-2026-115396 | medium | 5.5 | No | Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to... | 2026-10-29 |
| CVE-2026-115395 | medium | 5.5 | No | Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited th... | 2026-10-29 |
| CVE-2026-115394 | medium | 5.5 | No | Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap mem... | 2026-10-29 |
| CVE-2026-86981 | medium | 5.5 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An ap... | 2026-10-29 |
| CVE-2026-107041 | not reported | — | No | Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrar... | 2026-10-29 |
| CVE-2026-107040 | not reported | — | No | Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitra... | 2026-10-29 |
| CVE-2026-107038 | not reported | — | No | Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading... | 2026-10-29 |
| CVE-2026-107036 | not reported | — | No | Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impa... | 2026-10-29 |
| CVE-2026-107035 | not reported | — | No | Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers t... | 2026-10-29 |
| CVE-2026-107033 | not reported | — | No | Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbit... | 2026-10-29 |
| CVE-2026-107030 | not reported | — | No | Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (O... | 2026-10-29 |
| CVE-2026-107029 | not reported | — | No | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data acce... | 2026-10-29 |
| CVE-2026-107027 | not reported | — | No | Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading... | 2026-10-29 |
| CVE-2026-107025 | not reported | — | No | Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's dat... | 2026-10-29 |
| CVE-2026-106036 | not reported | — | No | Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without a... | 2026-10-29 |
| CVE-2026-66912 | not reported | — | No | Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insu... | 2026-10-29 |
| CVE-2026-66911 | not reported | — | No | Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitiza... | 2026-10-29 |
| CVE-2026-118673 | not reported | — | No | KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC brow... | 2026-10-29 |
| CVE-2026-112256 | not reported | — | No | Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Function... | 2026-10-29 |