Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111152 | medium | 5.5 | No | Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integ... | 2026-10-16 |
| CVE-2026-111151 | medium | 6.1 | No | OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt... | 2026-10-16 |
| CVE-2026-111148 | medium | 5.5 | No | libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/... | 2026-10-16 |
| CVE-2026-111146 | medium | 6.1 | No | ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by s... | 2026-10-16 |
| CVE-2026-111143 | medium | 5.5 | No | Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds c... | 2026-10-16 |
| CVE-2026-111138 | medium | 5.5 | No | NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run... | 2026-10-16 |
| CVE-2026-111137 | medium | 6.1 | No | libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fi... | 2026-10-16 |
| CVE-2026-111136 | medium | 6.1 | No | libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() doe... | 2026-10-16 |
| CVE-2026-111133 | medium | 6.1 | No | libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap ou... | 2026-10-16 |
| CVE-2026-111131 | medium | 6.1 | No | libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loade... | 2026-10-16 |
| CVE-2026-111128 | medium | 5.5 | No | Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications vi... | 2026-10-16 |
| CVE-2026-111127 | medium | 6.1 | No | catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read pa... | 2026-10-16 |
| CVE-2026-111126 | medium | 6.1 | No | catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows... | 2026-10-16 |
| CVE-2026-110878 | medium | 5.4 | No | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescape... | 2026-10-16 |
| CVE-2026-110877 | medium | 5.5 | No | AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past... | 2026-10-16 |
| CVE-2026-0993 | high | 7.5 | No | SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to ca... | 2026-10-16 |
| CVE-2026-110864 | high | 7.4 | No | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenti... | 2026-10-16 |
| CVE-2026-110862 | critical | 9.1 | No | Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in... | 2026-10-16 |
| CVE-2026-110660 | low | 3.3 | No | vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader re... | 2026-10-16 |
| CVE-2026-109438 | medium | 5.3 | No | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauth... | 2026-10-16 |