Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86009 | not reported | — | No | Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable... | 2026-10-21 |
| CVE-2026-49868 | critical | 9.8 | No | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07... | 2026-10-21 |
| CVE-2026-48741 | high | 7.5 | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P... | 2026-10-21 |
| CVE-2026-44977 | critical | 9.0 | No | countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api... | 2026-10-21 |
| CVE-2026-111604 | low | 3.8 | No | eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts... | 2026-10-21 |
| CVE-2026-111390 | medium | 5.3 | No | Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting... | 2026-10-21 |
| CVE-2026-111447 | high | 8.1 | No | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being sav... | 2026-10-21 |
| CVE-2026-111442 | not reported | — | No | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack poten... | 2026-10-21 |
| CVE-2026-111385 | medium | 4.8 | No | Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_... | 2026-10-21 |
| CVE-2026-111380 | high | 8.8 | No | FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the aud... | 2026-10-21 |
| CVE-2026-26846 | critical | 9.8 | No | Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the Ut... | 2026-10-21 |
| CVE-2026-95183 | high | 8.8 | No | An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack v... | 2026-10-21 |
| CVE-2026-111375 | critical | 9.1 | No | FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers t... | 2026-10-21 |
| CVE-2026-111367 | medium | 6.5 | No | BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and... | 2026-10-21 |
| CVE-2026-111359 | high | 7.1 | No | CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and... | 2026-10-21 |
| CVE-2026-111353 | medium | 4.3 | No | Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attach... | 2026-10-21 |
| CVE-2026-111237 | medium | 5.3 | No | A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_... | 2026-10-21 |
| CVE-2026-111348 | medium | 5.4 | No | Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenti... | 2026-10-21 |
| CVE-2026-111343 | medium | 4.3 | No | pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other... | 2026-10-21 |
| CVE-2026-111324 | medium | 5.3 | No | rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer rec... | 2026-10-21 |