Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110831 | medium | 4.3 | No | FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in... | 2026-10-23 |
| CVE-2026-110830 | high | 7.5 | No | FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file desc... | 2026-10-23 |
| CVE-2026-91411 | medium | 6.5 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).... | 2026-10-23 |
| CVE-2026-91409 | low | 3.7 | No | Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit... | 2026-10-23 |
| CVE-2026-91402 | low | 3.1 | No | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Support... | 2026-10-23 |
| CVE-2026-91399 | medium | 4.3 | No | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc... | 2026-10-23 |
| CVE-2026-90648 | not reported | — | No | wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fli... | 2026-10-23 |
| CVE-2026-111384 | medium | 6.5 | No | Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never... | 2026-10-23 |
| CVE-2026-111352 | high | 8.8 | No | ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administr... | 2026-10-23 |
| CVE-2026-111332 | low | 3.7 | No | OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after pas... | 2026-10-23 |
| CVE-2026-111312 | high | 7.7 | No | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELET... | 2026-10-23 |
| CVE-2026-111280 | high | 7.4 | No | snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overf... | 2026-10-23 |
| CVE-2026-110829 | medium | 6.5 | No | FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST wi... | 2026-10-23 |
| CVE-2026-18847 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. | 2026-10-23 |
| CVE-2026-57208 | not reported | — | No | Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allow... | 2026-10-23 |
| CVE-2026-63120 | high | 8.4 | No | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incompl... | 2026-10-23 |
| CVE-2026-115749 | low | 3.3 | No | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_... | 2026-10-23 |
| CVE-2026-105963 | not reported | — | No | Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauth... | 2026-10-23 |
| CVE-2026-110825 | high | 7.5 | No | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without... | 2026-10-23 |
| CVE-2026-110491 | high | 7.5 | No | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected ser... | 2026-10-23 |