Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91814 | medium | 5.5 | No | A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible... | 2026-10-29 |
| CVE-2026-91798 | high | 8.8 | No | A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuratio... | 2026-10-29 |
| CVE-2026-91794 | high | 7.8 | No | An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boun... | 2026-10-29 |
| CVE-2026-91788 | medium | 5.5 | No | When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the speci... | 2026-10-29 |
| CVE-2026-88010 | medium | 5.3 | No | Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.g... | 2026-10-29 |
| CVE-2026-83784 | high | 8.8 | No | Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network. | 2026-10-29 |
| CVE-2026-115396 | medium | 5.5 | No | Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to... | 2026-10-29 |
| CVE-2026-86981 | medium | 5.5 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An ap... | 2026-10-29 |
| CVE-2026-101772 | high | 8.1 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected... | 2026-10-29 |
| CVE-2026-101773 | high | 7.1 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions t... | 2026-10-29 |
| CVE-2026-119053 | medium | 5.3 | No | lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds co... | 2026-10-29 |
| CVE-2026-119049 | high | 7.6 | No | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbo... | 2026-10-29 |
| CVE-2026-118989 | medium | 5.5 | No | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_f... | 2026-10-29 |
| CVE-2026-42949 | medium | 5.6 | No | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r... | 2026-10-29 |
| CVE-2026-42922 | critical | 9.8 | No | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request... | 2026-10-29 |
| CVE-2026-40063 | medium | 5.3 | No | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially craft... | 2026-10-29 |
| CVE-2026-85749 | high | 8.1 | No | MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user,... | 2026-10-29 |
| CVE-2026-96951 | high | 8.8 | Listed | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa... | 2026-10-29 |
| CVE-2026-96202 | high | 8.8 | No | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-119028 | high | 8.8 | No | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enu... | 2026-10-29 |