Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89062 | medium | 5.5 | No | A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated use... | 2026-10-16 |
| CVE-2026-89057 | medium | 6.8 | No | A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una... | 2026-10-16 |
| CVE-2026-75941 | high | 8.0 | No | A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allo... | 2026-10-16 |
| CVE-2026-16755 | medium | 5.3 | No | A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauth... | 2026-10-16 |
| CVE-2026-16754 | medium | 4.8 | No | A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese ma... | 2026-10-16 |
| CVE-2026-108126 | not reported | — | No | temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is ena... | 2026-10-16 |
| CVE-2026-84731 | critical | 9.8 | No | An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element b... | 2026-10-16 |
| CVE-2026-97712 | not reported | — | No | Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the accoun... | 2026-10-16 |
| CVE-2026-97667 | not reported | — | No | Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the met... | 2026-10-16 |
| CVE-2026-97666 | not reported | — | No | Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call throu... | 2026-10-16 |
| CVE-2026-97665 | not reported | — | No | A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and br... | 2026-10-16 |
| CVE-2026-103509 | not reported | — | No | P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privile... | 2026-10-16 |
| CVE-2026-103508 | not reported | — | No | P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a craf... | 2026-10-16 |
| CVE-2026-104618 | medium | 6.2 | No | On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, ho... | 2026-10-16 |
| CVE-2026-104617 | medium | 5.1 | No | There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc acc... | 2026-10-16 |
| CVE-2023-32198 | high | 8.0 | No | A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presente... | 2026-10-16 |
| CVE-2026-110908 | high | 8.8 | No | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR s... | 2026-10-16 |
| CVE-2026-93637 | low | 3.7 | No | An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated p... | 2026-10-16 |
| CVE-2026-93635 | medium | 5.3 | No | LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search fi... | 2026-10-16 |
| CVE-2026-110736 | low | 3.6 | No | Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTr... | 2026-10-16 |