Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113643 | medium | 4.3 | No | A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/T... | 2026-10-20 |
| CVE-2026-112161 | not reported | — | No | MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker wi... | 2026-10-20 |
| CVE-2026-110759 | critical | 9.8 | No | Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in pars... | 2026-10-20 |
| CVE-2026-110758 | high | 7.5 | No | Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Un... | 2026-10-20 |
| CVE-2026-110757 | critical | 9.8 | No | Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and... | 2026-10-20 |
| CVE-2026-110756 | critical | 9.8 | No | Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 by... | 2026-10-20 |
| CVE-2026-110024 | medium | 6.8 | No | @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally co... | 2026-10-20 |
| CVE-2026-110755 | high | 7.5 | No | Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.... | 2026-10-20 |
| CVE-2026-110754 | medium | 6.5 | No | Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields o... | 2026-10-20 |
| CVE-2026-110753 | critical | 9.8 | No | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty lin... | 2026-10-20 |
| CVE-2026-110752 | high | 7.5 | No | Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. f... | 2026-10-20 |
| CVE-2026-108984 | high | 7.5 | No | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | 2026-10-20 |
| CVE-2026-108709 | critical | 9.8 | No | Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network... | 2026-10-20 |
| CVE-2026-109588 | high | 8.8 | No | Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (... | 2026-10-20 |
| CVE-2026-108096 | medium | 6.5 | No | Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 m... | 2026-10-20 |
| CVE-2026-104679 | high | 7.1 | No | VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project fil... | 2026-10-20 |
| CVE-2026-102204 | high | 7.8 | No | Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privi... | 2026-10-20 |
| CVE-2026-111677 | medium | 5.5 | No | Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the... | 2026-10-20 |
| CVE-2026-34633 | high | 7.7 | No | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged att... | 2026-10-20 |
| CVE-2026-34634 | high | 8.6 | No | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this... | 2026-10-20 |