Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117553 | high | 7.5 | No | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attac... | 2026-10-27 |
| CVE-2026-10537 | medium | 5.3 | No | A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users... | 2026-10-27 |
| CVE-2026-116627 | not reported | — | No | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell... | 2026-10-27 |
| CVE-2026-114409 | not reported | — | No | Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and dia... | 2026-10-27 |
| CVE-2026-41022 | medium | 5.9 | No | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to... | 2026-10-27 |
| CVE-2026-41021 | high | 7.5 | No | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could... | 2026-10-27 |
| CVE-2026-41020 | high | 7.5 | No | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication... | 2026-10-27 |
| CVE-2026-110737 | not reported | — | No | The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response he... | 2026-10-27 |
| CVE-2026-101034 | not reported | — | No | An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords st... | 2026-10-27 |
| CVE-2026-88781 | not reported | — | No | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory add... | 2026-10-27 |
| CVE-2026-116801 | medium | 4.3 | No | Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so... | 2026-10-27 |
| CVE-2026-116741 | medium | 6.5 | No | Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishan... | 2026-10-27 |
| CVE-2026-116591 | not reported | — | No | compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted t... | 2026-10-27 |
| CVE-2026-116588 | not reported | — | No | Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expre... | 2026-10-27 |
| CVE-2026-116671 | not reported | — | No | Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image. | 2026-10-27 |
| CVE-2026-116579 | medium | 5.9 | No | Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBr... | 2026-10-27 |
| CVE-2026-110720 | critical | 9.9 | No | Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow... | 2026-10-27 |
| CVE-2026-116840 | medium | 6.1 | No | llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size chec... | 2026-10-27 |
| CVE-2026-116829 | medium | 6.6 | No | llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor el... | 2026-10-27 |
| CVE-2026-105006 | medium | 6.4 | No | Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack. | 2026-10-27 |