Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111313 | medium | 6.5 | No | JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authentica... | 2026-10-21 |
| CVE-2026-111281 | critical | 9.8 | No | Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticate... | 2026-10-21 |
| CVE-2026-111275 | medium | 6.1 | No | nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2... | 2026-10-21 |
| CVE-2026-111270 | medium | 6.1 | No | libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never chec... | 2026-10-21 |
| CVE-2026-111170 | medium | 6.5 | No | kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write f... | 2026-10-21 |
| CVE-2026-111165 | medium | 5.5 | No | libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel... | 2026-10-21 |
| CVE-2026-111160 | high | 7.5 | No | LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by sup... | 2026-10-21 |
| CVE-2026-111155 | medium | 6.1 | No | libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sa... | 2026-10-21 |
| CVE-2026-111150 | medium | 5.5 | No | ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an u... | 2026-10-21 |
| CVE-2026-111145 | medium | 6.1 | No | ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize... | 2026-10-21 |
| CVE-2026-111140 | medium | 6.1 | No | libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size withou... | 2026-10-21 |
| CVE-2026-111135 | medium | 6.1 | No | libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to... | 2026-10-21 |
| CVE-2026-111130 | medium | 6.1 | No | OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_po... | 2026-10-21 |
| CVE-2026-111125 | high | 7.1 | No | CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read pas... | 2026-10-21 |
| CVE-2026-110876 | medium | 5.5 | No | AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying... | 2026-10-21 |
| CVE-2026-57496 | critical | 9.6 | No | NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs... | 2026-10-21 |
| CVE-2026-55872 | high | 8.7 | No | GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/use... | 2026-10-21 |
| CVE-2026-55239 | high | 8.8 | No | Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/serv... | 2026-10-21 |
| CVE-2026-55876 | low | 3.5 | No | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint a... | 2026-10-21 |
| CVE-2026-93908 | medium | 6.4 | No | The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b... | 2026-10-21 |