Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116199 | high | 8.1 | No | Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username... | 2026-10-26 |
| CVE-2026-116596 | not reported | — | No | Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService... | 2026-10-26 |
| CVE-2026-65184 | critical | 9.8 | No | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system(... | 2026-10-26 |
| CVE-2026-3322 | not reported | — | No | Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privilege... | 2026-10-26 |
| CVE-2026-116339 | high | 7.3 | No | A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1... | 2026-10-26 |
| CVE-2026-112345 | high | 8.1 | No | TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allow... | 2026-10-26 |
| CVE-2026-116275 | medium | 6.3 | No | A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/co... | 2026-10-26 |
| CVE-2026-116486 | medium | 4.5 | No | Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by expl... | 2026-10-26 |
| CVE-2026-111590 | not reported | — | No | A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, al... | 2026-10-26 |
| CVE-2026-107157 | not reported | — | No | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework. | 2026-10-26 |
| CVE-2026-96432 | not reported | — | No | A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and th... | 2026-10-26 |
| CVE-2026-116072 | medium | 5.4 | No | Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an att... | 2026-10-26 |
| CVE-2026-116011 | high | 7.5 | No | Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to cra... | 2026-10-26 |
| CVE-2026-115897 | not reported | — | No | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the... | 2026-10-26 |
| CVE-2026-98119 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfs_alloc_subrequest() fails syzb... | 2026-10-26 |
| CVE-2026-98120 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfs_unbuffer... | 2026-10-26 |
| CVE-2026-98140 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths wri... | 2026-10-26 |
| CVE-2026-98143 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits... | 2026-10-26 |
| CVE-2026-72758 | high | 7.5 | No | When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will ne... | 2026-10-26 |
| CVE-2026-72757 | medium | 5.3 | No | Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavai... | 2026-10-26 |