Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116099 | high | 8.8 | No | A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks o... | 2026-10-29 |
| CVE-2026-116111 | critical | 9.6 | No | A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Execu... | 2026-10-29 |
| CVE-2026-113957 | not reported | — | No | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pul... | 2026-10-29 |
| CVE-2026-86983 | not reported | — | No | A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its lengt... | 2026-10-29 |
| CVE-2026-106484 | medium | 4.4 | No | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrar... | 2026-10-29 |
| CVE-2026-93536 | medium | 5.3 | No | A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWay... | 2026-10-29 |
| CVE-2026-93524 | not reported | — | No | A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to... | 2026-10-29 |
| CVE-2026-93523 | high | 7.8 | No | A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XW... | 2026-10-29 |
| CVE-2026-83525 | not reported | — | No | Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all pl... | 2026-10-29 |
| CVE-2026-118581 | medium | 6.5 | No | A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees... | 2026-10-29 |
| CVE-2026-118510 | high | 8.8 | No | A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related r... | 2026-10-29 |
| CVE-2026-117626 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for worksp... | 2026-10-29 |
| CVE-2026-117625 | not reported | — | No | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the... | 2026-10-29 |
| CVE-2026-117624 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as... | 2026-10-29 |
| CVE-2026-117623 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, r... | 2026-10-29 |
| CVE-2026-117622 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the c... | 2026-10-29 |
| CVE-2026-117621 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file an... | 2026-10-29 |
| CVE-2026-117620 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data... | 2026-10-29 |
| CVE-2026-117619 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke... | 2026-10-29 |
| CVE-2026-117618 | not reported | — | No | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu... | 2026-10-29 |