Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110644 | critical | 9.8 | No | nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands... | 2026-10-16 |
| CVE-2026-110639 | critical | 9.8 | No | @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell met... | 2026-10-16 |
| CVE-2026-110634 | critical | 9.8 | No | git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted st... | 2026-10-16 |
| CVE-2026-110629 | medium | 6.5 | No | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role p... | 2026-10-16 |
| CVE-2026-110617 | medium | 4.8 | No | we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthen... | 2026-10-16 |
| CVE-2026-110612 | critical | 9.8 | No | vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded... | 2026-10-16 |
| CVE-2026-110607 | medium | 6.5 | No | BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark ord... | 2026-10-16 |
| CVE-2026-110602 | medium | 6.3 | No | libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filen... | 2026-10-16 |
| CVE-2026-110598 | medium | 6.1 | No | Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap... | 2026-10-16 |
| CVE-2026-110597 | medium | 6.1 | No | Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read... | 2026-10-16 |
| CVE-2017-20286 | high | 7.8 | No | DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte pa... | 2026-10-16 |
| CVE-2016-20099 | medium | 5.5 | No | L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows attackers to hang a... | 2026-10-16 |
| CVE-2026-82026 | high | 8.8 | No | Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that... | 2026-10-16 |
| CVE-2026-110131 | medium | 5.3 | No | ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allow... | 2026-10-16 |
| CVE-2026-110129 | medium | 6.5 | No | fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail... | 2026-10-16 |
| CVE-2026-110126 | medium | 5.4 | No | waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated member... | 2026-10-16 |
| CVE-2026-110125 | medium | 6.3 | No | Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modif... | 2026-10-16 |
| CVE-2026-110124 | high | 8.1 | No | FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege... | 2026-10-16 |
| CVE-2026-110121 | medium | 6.5 | No | PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any... | 2026-10-16 |
| CVE-2026-110116 | critical | 9.1 | No | Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that a... | 2026-10-16 |