Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111312 | high | 7.7 | No | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELET... | 2026-10-23 |
| CVE-2026-111280 | high | 7.4 | No | snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overf... | 2026-10-23 |
| CVE-2026-110829 | medium | 6.5 | No | FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST wi... | 2026-10-23 |
| CVE-2026-18847 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. | 2026-10-23 |
| CVE-2026-57208 | not reported | — | No | Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allow... | 2026-10-23 |
| CVE-2026-63120 | high | 8.4 | No | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incompl... | 2026-10-23 |
| CVE-2026-115749 | low | 3.3 | No | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_... | 2026-10-23 |
| CVE-2026-105963 | not reported | — | No | Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauth... | 2026-10-23 |
| CVE-2026-110825 | high | 7.5 | No | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without... | 2026-10-23 |
| CVE-2026-110491 | high | 7.5 | No | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected ser... | 2026-10-23 |
| CVE-2026-110243 | critical | 9.9 | No | The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its lin... | 2026-10-23 |
| CVE-2026-107861 | critical | 9.9 | No | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device nami... | 2026-10-23 |
| CVE-2026-96616 | medium | 6.5 | No | Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session li... | 2026-10-23 |
| CVE-2026-111100 | medium | 5.3 | No | The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated pa... | 2026-10-23 |
| CVE-2026-109122 | critical | 9.1 | No | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes... | 2026-10-23 |
| CVE-2026-105265 | medium | 5.3 | No | A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to ca... | 2026-10-23 |
| CVE-2026-13599 | high | 7.8 | No | Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0. | 2026-10-23 |
| CVE-2026-69673 | high | 7.8 | No | Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally... | 2026-10-23 |
| CVE-2026-69718 | high | 7.8 | No | Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to eleva... | 2026-10-23 |
| CVE-2026-69733 | high | 7.8 | No | Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | 2026-10-23 |