Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112057 | medium | 5.5 | No | libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyo... | 2026-10-19 |
| CVE-2026-112056 | medium | 5.5 | No | wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash a... | 2026-10-19 |
| CVE-2026-112055 | medium | 5.5 | No | wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated... | 2026-10-19 |
| CVE-2026-112052 | medium | 6.1 | No | libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and rela... | 2026-10-19 |
| CVE-2026-112051 | medium | 6.5 | No | Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitr... | 2026-10-19 |
| CVE-2026-112050 | low | 3.1 | No | Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to the... | 2026-10-19 |
| CVE-2026-112021 | high | 7.5 | No | snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers... | 2026-10-19 |
| CVE-2026-112017 | medium | 6.5 | No | JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword bl... | 2026-10-19 |
| CVE-2026-112016 | medium | 6.5 | No | Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows r... | 2026-10-19 |
| CVE-2026-112015 | high | 7.5 | No | Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_e... | 2026-10-19 |
| CVE-2026-112013 | medium | 5.5 | No | libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by sup... | 2026-10-19 |
| CVE-2026-112012 | medium | 5.3 | No | libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame... | 2026-10-19 |
| CVE-2026-112011 | medium | 5.3 | No | libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer ov... | 2026-10-19 |
| CVE-2026-112010 | medium | 5.5 | No | smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_si... | 2026-10-19 |
| CVE-2026-112009 | medium | 5.5 | No | smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 1638... | 2026-10-19 |
| CVE-2026-112008 | medium | 6.1 | No | libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory bec... | 2026-10-19 |
| CVE-2026-112007 | medium | 6.1 | No | Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp th... | 2026-10-19 |
| CVE-2026-112006 | medium | 6.5 | No | OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disa... | 2026-10-19 |
| CVE-2026-111998 | critical | 9.8 | No | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin ac... | 2026-10-19 |
| CVE-2026-111923 | high | 7.5 | No | Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated... | 2026-10-19 |