Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103834 | high | 7.8 | No | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the... | 2026-10-19 |
| CVE-2026-103833 | high | 7.8 | No | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the... | 2026-10-19 |
| CVE-2026-103832 | high | 7.8 | No | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the... | 2026-10-19 |
| CVE-2026-103830 | high | 7.8 | No | Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context... | 2026-10-19 |
| CVE-2026-111438 | medium | 6.5 | No | 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，... | 2026-10-19 |
| CVE-2026-111439 | medium | 4.3 | No | 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在... | 2026-10-19 |
| CVE-2026-111440 | high | 7.0 | No | 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用... | 2026-10-19 |
| CVE-2026-111441 | high | 8.1 | No | 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL... | 2026-10-19 |
| CVE-2026-4418 | medium | 5.4 | No | IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML cod... | 2026-10-19 |
| CVE-2026-3295 | high | 7.4 | No | IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized o... | 2026-10-19 |
| CVE-2026-111748 | not reported | — | No | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form reque... | 2026-10-19 |
| CVE-2026-111065 | not reported | — | No | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip cl... | 2026-10-19 |
| CVE-2026-59966 | medium | 5.7 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controll... | 2026-10-19 |
| CVE-2026-97859 | medium | 6.5 | No | Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys... | 2026-10-19 |
| CVE-2026-86375 | medium | 6.2 | No | Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated at... | 2026-10-19 |
| CVE-2026-96542 | medium | 5.0 | No | Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.147... | 2026-10-19 |
| CVE-2026-109855 | high | 7.5 | No | undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default... | 2026-10-19 |
| CVE-2026-109383 | critical | 9.1 | No | undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent di... | 2026-10-19 |
| CVE-2026-91858 | medium | 6.5 | No | FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newI... | 2026-10-19 |
| CVE-2026-88901 | high | 8.2 | No | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.1... | 2026-10-19 |