Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-11831 | medium | 5.4 | No | IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory l... | 2026-10-23 |
| CVE-2026-11829 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. | 2026-10-23 |
| CVE-2026-110839 | high | 7.1 | No | FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg beca... | 2026-10-23 |
| CVE-2026-110834 | medium | 6.5 | No | FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sen... | 2026-10-23 |
| CVE-2026-110835 | medium | 5.8 | No | FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: ms... | 2026-10-23 |
| CVE-2026-110836 | medium | 6.5 | No | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust c... | 2026-10-23 |
| CVE-2026-110837 | high | 7.1 | No | FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp... | 2026-10-23 |
| CVE-2026-110838 | high | 7.5 | No | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthe... | 2026-10-23 |
| CVE-2026-110833 | high | 7.5 | No | FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the... | 2026-10-23 |
| CVE-2026-110832 | medium | 6.5 | No | FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients... | 2026-10-23 |
| CVE-2026-110831 | medium | 4.3 | No | FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in... | 2026-10-23 |
| CVE-2026-110830 | high | 7.5 | No | FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file desc... | 2026-10-23 |
| CVE-2026-91411 | medium | 6.5 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).... | 2026-10-23 |
| CVE-2026-91409 | low | 3.7 | No | Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit... | 2026-10-23 |
| CVE-2026-91402 | low | 3.1 | No | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Support... | 2026-10-23 |
| CVE-2026-91399 | medium | 4.3 | No | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc... | 2026-10-23 |
| CVE-2026-90648 | not reported | — | No | wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fli... | 2026-10-23 |
| CVE-2026-111384 | medium | 6.5 | No | Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never... | 2026-10-23 |
| CVE-2026-111352 | high | 8.8 | No | ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administr... | 2026-10-23 |
| CVE-2026-111332 | low | 3.7 | No | OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after pas... | 2026-10-23 |