Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114473 | medium | 5.0 | No | Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker t... | 2026-10-29 |
| CVE-2026-114472 | low | 3.7 | No | Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unau... | 2026-10-29 |
| CVE-2026-114471 | medium | 4.7 | No | Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local us... | 2026-10-29 |
| CVE-2026-114470 | medium | 5.3 | No | Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenti... | 2026-10-29 |
| CVE-2026-107037 | high | 7.5 | No | Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in ano... | 2026-10-29 |
| CVE-2026-107032 | critical | 9.1 | No | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l... | 2026-10-29 |
| CVE-2026-107026 | high | 7.5 | No | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's cl... | 2026-10-29 |
| CVE-2026-107020 | high | 7.5 | No | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim user... | 2026-10-29 |
| CVE-2026-107091 | high | 7.8 | No | An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver i... | 2026-10-29 |
| CVE-2026-105215 | critical | 9.1 | No | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not fo... | 2026-10-29 |
| CVE-2026-105212 | high | 7.5 | No | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passk... | 2026-10-29 |
| CVE-2026-105210 | high | 8.2 | No | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enroll... | 2026-10-29 |
| CVE-2026-105209 | critical | 9.6 | No | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrol... | 2026-10-29 |
| CVE-2026-105208 | high | 7.7 | No | ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticat... | 2026-10-29 |
| CVE-2026-105207 | critical | 9.8 | No | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a... | 2026-10-29 |
| CVE-2026-105206 | not reported | — | No | ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.rea... | 2026-10-29 |
| CVE-2026-104596 | high | 7.5 | No | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This... | 2026-10-29 |
| CVE-2026-104591 | high | 7.5 | No | libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to... | 2026-10-29 |
| CVE-2026-102486 | high | 7.5 | No | Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS... | 2026-10-29 |
| CVE-2026-102485 | medium | 5.2 | No | Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's ser... | 2026-10-29 |