Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-59087 | high | 7.8 | No | A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could expl... | 2026-11-04 |
| CVE-2026-59691 | high | 7.1 | No | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that adver... | 2026-11-04 |
| CVE-2026-58384 | high | 7.8 | No | A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-len... | 2026-11-04 |
| CVE-2026-59090 | critical | 9.9 | No | A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs whe... | 2026-11-04 |
| CVE-2026-57152 | not reported | — | No | GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLP... | 2026-11-04 |
| CVE-2026-58379 | high | 7.3 | No | A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to caus... | 2026-11-04 |
| CVE-2026-58016 | critical | 9.1 | No | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when process... | 2026-11-04 |
| CVE-2026-56211 | high | 7.1 | No | A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1... | 2026-11-04 |
| CVE-2026-56210 | high | 7.1 | No | A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Sc... | 2026-11-04 |
| CVE-2026-56209 | high | 7.1 | No | An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Sca... | 2026-11-04 |
| CVE-2026-54384 | critical | 9.8 | No | VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session f... | 2026-11-04 |
| CVE-2026-54383 | medium | 6.5 | No | VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /... | 2026-11-04 |
| CVE-2026-54382 | high | 7.7 | No | VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authentica... | 2026-11-04 |
| CVE-2026-54381 | high | 7.5 | No | VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to li... | 2026-11-04 |
| CVE-2026-56208 | high | 7.6 | No | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Pro... | 2026-11-04 |
| CVE-2026-54230 | high | 7.8 | No | A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files usi... | 2026-11-04 |
| CVE-2026-54229 | high | 7.0 | No | A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_RE... | 2026-11-04 |
| CVE-2026-53631 | not reported | — | No | GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could... | 2026-11-04 |
| CVE-2026-52848 | not reported | — | No | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use... | 2026-11-04 |
| CVE-2026-52722 | high | 7.1 | No | A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overfl... | 2026-11-04 |