Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84823 | high | 7.1 | No | A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit... | 2026-10-26 |
| CVE-2026-4316 | not reported | — | No | Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' p... | 2026-10-26 |
| CVE-2026-115635 | not reported | — | No | Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. W... | 2026-10-26 |
| CVE-2026-115627 | not reported | — | No | Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only t... | 2026-10-26 |
| CVE-2026-115425 | not reported | — | No | Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to... | 2026-10-26 |
| CVE-2026-113438 | medium | 6.5 | No | Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain confi... | 2026-10-26 |
| CVE-2026-113345 | high | 7.8 | No | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an i... | 2026-10-26 |
| CVE-2026-114214 | not reported | — | No | Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through... | 2026-10-26 |
| CVE-2026-111269 | medium | 6.1 | No | libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding in... | 2026-10-26 |
| CVE-2026-111159 | medium | 6.1 | No | libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name an... | 2026-10-26 |
| CVE-2026-111154 | medium | 6.1 | No | libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack... | 2026-10-26 |
| CVE-2026-111149 | medium | 6.1 | No | FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowByt... | 2026-10-26 |
| CVE-2026-111144 | medium | 5.5 | No | libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applicat... | 2026-10-26 |
| CVE-2026-111139 | medium | 5.5 | No | NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past... | 2026-10-26 |
| CVE-2026-111134 | medium | 6.1 | No | libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers... | 2026-10-26 |
| CVE-2026-107900 | high | 7.8 | No | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7... | 2026-10-26 |
| CVE-2026-107899 | high | 7.8 | No | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroPa... | 2026-10-26 |
| CVE-2026-107898 | high | 7.8 | No | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck.... | 2026-10-26 |
| CVE-2026-107897 | high | 7.8 | No | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafte... | 2026-10-26 |
| CVE-2026-111129 | medium | 5.5 | No | Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's Ogre... | 2026-10-26 |