Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117561 | high | 7.8 | No | Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying c... | 2026-10-27 |
| CVE-2026-117559 | high | 7.8 | No | DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(... | 2026-10-27 |
| CVE-2026-117558 | high | 7.8 | No | The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by sup... | 2026-10-27 |
| CVE-2026-117555 | medium | 6.1 | No | CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in t... | 2026-10-27 |
| CVE-2026-115408 | medium | 5.5 | No | In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`,... | 2026-10-27 |
| CVE-2026-115216 | not reported | — | No | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller AP... | 2026-10-27 |
| CVE-2026-113644 | not reported | — | No | In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the... | 2026-10-27 |
| CVE-2026-117530 | medium | 6.7 | No | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands | 2026-10-27 |
| CVE-2026-116843 | high | 8.8 | No | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter driver... | 2026-10-27 |
| CVE-2026-116841 | medium | 5.5 | No | DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function th... | 2026-10-27 |
| CVE-2026-116747 | high | 8.1 | No | Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by u... | 2026-10-27 |
| CVE-2026-116743 | medium | 5.5 | No | libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt... | 2026-10-27 |
| CVE-2026-116742 | medium | 4.4 | No | HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to... | 2026-10-27 |
| CVE-2026-116739 | medium | 4.3 | No | VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memor... | 2026-10-27 |
| CVE-2026-116738 | high | 8.8 | No | VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based bu... | 2026-10-27 |
| CVE-2026-116737 | medium | 6.1 | No | libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the dire... | 2026-10-27 |
| CVE-2026-116735 | medium | 6.1 | No | libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap o... | 2026-10-27 |
| CVE-2026-116731 | medium | 6.1 | No | Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory v... | 2026-10-27 |
| CVE-2026-116730 | medium | 5.5 | No | Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered b... | 2026-10-27 |
| CVE-2026-116575 | medium | 6.3 | No | Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_s... | 2026-10-27 |