Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116747 | high | 8.1 | No | Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by u... | 2026-10-27 |
| CVE-2026-116743 | medium | 5.5 | No | libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt... | 2026-10-27 |
| CVE-2026-116742 | medium | 4.4 | No | HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to... | 2026-10-27 |
| CVE-2026-116739 | medium | 4.3 | No | VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memor... | 2026-10-27 |
| CVE-2026-116738 | high | 8.8 | No | VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based bu... | 2026-10-27 |
| CVE-2026-116735 | medium | 6.1 | No | libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap o... | 2026-10-27 |
| CVE-2026-116731 | medium | 6.1 | No | Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory v... | 2026-10-27 |
| CVE-2026-116730 | medium | 5.5 | No | Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered b... | 2026-10-27 |
| CVE-2026-116575 | medium | 6.3 | No | Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_s... | 2026-10-27 |
| CVE-2026-115533 | not reported | — | No | The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and rel... | 2026-10-27 |
| CVE-2026-117602 | high | 8.4 | No | Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module whe... | 2026-10-27 |
| CVE-2026-117557 | medium | 6.1 | No | SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips... | 2026-10-27 |
| CVE-2026-117553 | high | 7.5 | No | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attac... | 2026-10-27 |
| CVE-2026-10537 | medium | 5.3 | No | A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users... | 2026-10-27 |
| CVE-2026-116627 | not reported | — | No | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell... | 2026-10-27 |
| CVE-2026-114409 | not reported | — | No | Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and dia... | 2026-10-27 |
| CVE-2026-41022 | medium | 5.9 | No | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to... | 2026-10-27 |
| CVE-2026-41021 | high | 7.5 | No | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could... | 2026-10-27 |
| CVE-2026-41020 | high | 7.5 | No | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication... | 2026-10-27 |
| CVE-2026-110737 | not reported | — | No | The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response he... | 2026-10-27 |