Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109376 | medium | 4.3 | No | ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated p... | 2026-10-26 |
| CVE-2026-109422 | high | 8.1 | No | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in... | 2026-10-26 |
| CVE-2026-109366 | low | 3.7 | No | Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated p... | 2026-10-26 |
| CVE-2026-109361 | high | 7.3 | No | MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path re... | 2026-10-26 |
| CVE-2026-41586 | critical | 9.8 | No | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions... | 2026-10-26 |
| CVE-2026-44603 | critical | 9.1 | No | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. | 2026-10-26 |
| CVE-2026-42994 | critical | 9.8 | No | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to... | 2026-10-26 |
| CVE-2026-2311 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check... | 2026-10-26 |
| CVE-2026-33447 | critical | 9.8 | No | CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a... | 2026-10-26 |
| CVE-2026-42799 | critical | 9.8 | No | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associated with program file... | 2026-10-26 |
| CVE-2026-22070 | critical | 9.8 | No | ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal. | 2026-10-26 |
| CVE-2026-7248 | critical | 9.4 | No | A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the function tgfile_htm of the file tgfile.htm of the component CGI End... | 2026-10-26 |
| CVE-2026-41473 | critical | 9.1 | No | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthe... | 2026-10-26 |
| CVE-2026-41415 | critical | 9.1 | No | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when pars... | 2026-10-26 |
| CVE-2026-41274 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forward... | 2026-10-26 |
| CVE-2026-33819 | critical | 9.8 | No | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-26150 | critical | 10.0 | No | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-41267 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON i... | 2026-10-26 |
| CVE-2026-41264 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the... | 2026-10-26 |
| CVE-2026-41247 | critical | 9.8 | No | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injecti... | 2026-10-26 |