Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109712 | high | 7.1 | No | Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firef... | 2026-10-16 |
| CVE-2026-108674 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged... | 2026-10-16 |
| CVE-2026-105836 | medium | 5.4 | No | QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hote... | 2026-10-16 |
| CVE-2026-103500 | medium | 6.1 | No | An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnera... | 2026-10-16 |
| CVE-2026-102476 | not reported | — | No | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency... | 2026-10-16 |
| CVE-2026-108128 | medium | 6.5 | No | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 2026-10-16 |
| CVE-2026-108127 | medium | 6.5 | No | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 2026-10-16 |
| CVE-2026-70045 | high | 7.0 | No | Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-70044 | medium | 5.5 | No | Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-110717 | medium | 5.3 | No | Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to... | 2026-10-16 |
| CVE-2026-110652 | medium | 4.0 | No | ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid en... | 2026-10-16 |
| CVE-2026-109597 | medium | 5.4 | No | Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML b... | 2026-10-16 |
| CVE-2026-109596 | medium | 5.5 | No | Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files out... | 2026-10-16 |
| CVE-2026-109563 | high | 7.5 | No | N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadraticall... | 2026-10-16 |
| CVE-2026-109355 | medium | 6.1 | No | LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields an... | 2026-10-16 |
| CVE-2026-109308 | high | 8.8 | No | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to Up... | 2026-10-16 |
| CVE-2026-108114 | medium | 4.3 | No | Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manag... | 2026-10-16 |
| CVE-2026-70041 | medium | 5.5 | No | Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-70038 | high | 8.1 | No | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-70031 | high | 7.5 | No | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network. | 2026-10-16 |