Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73260 | high | 7.5 | No | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails... | 2026-10-20 |
| CVE-2026-55167 | medium | 4.2 | No | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9... | 2026-10-20 |
| CVE-2026-110773 | medium | 4.3 | No | GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list... | 2026-10-20 |
| CVE-2026-110768 | medium | 4.8 | No | holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders b... | 2026-10-20 |
| CVE-2026-54554 | high | 7.5 | No | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint i... | 2026-10-20 |
| CVE-2026-77524 | critical | 9.9 | No | KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create Trigg... | 2026-10-20 |
| CVE-2026-110763 | medium | 4.3 | No | lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findD... | 2026-10-20 |
| CVE-2026-110735 | low | 2.5 | No | Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderB... | 2026-10-20 |
| CVE-2026-110719 | high | 7.2 | No | Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach... | 2026-10-20 |
| CVE-2026-110714 | medium | 6.5 | No | libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bound... | 2026-10-20 |
| CVE-2026-110659 | medium | 5.5 | No | ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to cra... | 2026-10-20 |
| CVE-2026-110654 | medium | 6.1 | No | libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supp... | 2026-10-20 |
| CVE-2026-110646 | high | 8.1 | No | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands b... | 2026-10-20 |
| CVE-2026-110641 | high | 8.8 | No | @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supp... | 2026-10-20 |
| CVE-2026-110636 | critical | 9.8 | No | pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shel... | 2026-10-20 |
| CVE-2026-110631 | critical | 9.8 | No | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect... | 2026-10-20 |
| CVE-2026-110626 | medium | 6.1 | No | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencod... | 2026-10-20 |
| CVE-2026-110621 | high | 8.8 | No | Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to... | 2026-10-20 |
| CVE-2026-110616 | high | 8.1 | No | NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* managem... | 2026-10-20 |
| CVE-2026-110611 | medium | 5.9 | No | REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied cha... | 2026-10-20 |