Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91189 | not reported | — | No | The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header... | 2026-10-20 |
| CVE-2026-91186 | not reported | — | No | The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied trans... | 2026-10-20 |
| CVE-2026-91059 | not reported | — | No | The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the... | 2026-10-20 |
| CVE-2026-96582 | medium | 4.9 | No | A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence b... | 2026-10-20 |
| CVE-2026-96406 | medium | 4.9 | No | A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. Th... | 2026-10-20 |
| CVE-2026-91041 | high | 7.8 | No | Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is at... | 2026-10-20 |
| CVE-2026-113620 | critical | 9.8 | No | In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JW... | 2026-10-20 |
| CVE-2026-113619 | high | 7.5 | No | In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are render... | 2026-10-20 |
| CVE-2026-108062 | not reported | — | No | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the wh... | 2026-10-20 |
| CVE-2026-107597 | not reported | — | No | PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the... | 2026-10-20 |
| CVE-2026-61411 | high | 7.7 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A lo... | 2026-10-20 |
| CVE-2026-63689 | medium | 6.5 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A lo... | 2026-10-20 |
| CVE-2026-76105 | high | 7.1 | No | Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated... | 2026-10-20 |
| CVE-2026-106159 | medium | 4.7 | No | In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatena... | 2026-10-20 |
| CVE-2026-106160 | medium | 5.4 | No | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against un... | 2026-10-20 |
| CVE-2026-106161 | medium | 5.4 | No | In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values a... | 2026-10-20 |
| CVE-2026-106162 | medium | 4.7 | No | In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely su... | 2026-10-20 |
| CVE-2026-106163 | medium | 6.5 | No | In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components... | 2026-10-20 |
| CVE-2026-106149 | medium | 5.4 | No | In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by strin... | 2026-10-20 |
| CVE-2026-106151 | medium | 5.4 | No | In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from... | 2026-10-20 |