Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-44038 | medium | 4.4 | No | A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK... | 2026-10-08 |
| CVE-2026-44037 | medium | 5.5 | No | Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcm... | 2026-10-08 |
| CVE-2026-44036 | medium | 5.5 | No | Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter... | 2026-10-08 |
| CVE-2026-44035 | medium | 5.5 | No | Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a d... | 2026-10-08 |
| CVE-2026-44034 | medium | 4.4 | No | A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker t... | 2026-10-08 |
| CVE-2026-44033 | medium | 5.5 | No | Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS... | 2026-10-08 |
| CVE-2026-44031 | high | 7.5 | No | Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauth... | 2026-10-08 |
| CVE-2026-92862 | low | 3.3 | No | The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an... | 2026-10-08 |
| CVE-2026-92861 | medium | 4.0 | No | The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the... | 2026-10-08 |
| CVE-2026-62252 | critical | 9.8 | No | Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authenticatio... | 2026-10-08 |
| CVE-2026-62251 | high | 8.1 | No | Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `ra... | 2026-10-08 |
| CVE-2026-19585 | medium | 5.3 | No | HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directo... | 2026-10-08 |
| CVE-2026-102784 | not reported | — | No | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the... | 2026-10-08 |
| CVE-2026-102783 | not reported | — | No | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logi... | 2026-10-08 |
| CVE-2026-105820 | medium | 5.4 | No | Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned... | 2026-10-08 |
| CVE-2026-105818 | medium | 5.9 | No | Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificate... | 2026-10-08 |
| CVE-2026-107207 | high | 7.2 | No | LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated at... | 2026-10-08 |
| CVE-2026-107206 | critical | 9.4 | No | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticate... | 2026-10-08 |
| CVE-2026-107205 | high | 8.6 | No | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated att... | 2026-10-08 |
| CVE-2026-107204 | critical | 9.8 | No | LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by... | 2026-10-08 |