Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77474 | high | 7.1 | No | destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior... | 2026-10-19 |
| CVE-2026-59967 | medium | 5.4 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletIm... | 2026-10-19 |
| CVE-2026-68906 | not reported | — | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P... | 2026-10-19 |
| CVE-2026-41582 | high | 7.5 | No | countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot... | 2026-10-19 |
| CVE-2026-111620 | medium | 5.3 | No | O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users... | 2026-10-19 |
| CVE-2026-111615 | medium | 6.5 | No | Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' b... | 2026-10-19 |
| CVE-2026-111610 | medium | 5.4 | No | B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other... | 2026-10-19 |
| CVE-2026-111605 | high | 8.1 | No | Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access... | 2026-10-19 |
| CVE-2026-109766 | high | 8.1 | No | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and... | 2026-10-19 |
| CVE-2026-109760 | high | 8.1 | No | Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Th... | 2026-10-19 |
| CVE-2026-109759 | high | 8.1 | No | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thund... | 2026-10-19 |
| CVE-2026-109754 | high | 8.1 | No | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158,... | 2026-10-19 |
| CVE-2026-109747 | high | 7.3 | No | Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-19 |
| CVE-2026-109746 | high | 7.3 | No | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-19 |
| CVE-2026-109745 | critical | 9.6 | No | Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5,... | 2026-10-19 |
| CVE-2026-102552 | medium | 5.9 | No | Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow rem... | 2026-10-19 |
| CVE-2026-102551 | high | 7.7 | No | Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V... | 2026-10-19 |
| CVE-2026-105445 | not reported | — | No | An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker... | 2026-10-19 |
| CVE-2026-69992 | high | 7.5 | No | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2025-66205 | critical | 9.8 | No | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injecti... | 2026-10-19 |