Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2023-5685 | high | 7.5 | No | A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problem... | 2026-11-04 |
| CVE-2023-5574 | high | 7.0 | No | A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-sc... | 2026-11-04 |
| CVE-2023-5633 | high | 7.8 | No | The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory obje... | 2026-11-04 |
| CVE-2023-5557 | high | 7.7 | No | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sand... | 2026-11-04 |
| CVE-2023-5367 | high | 7.8 | No | A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copyi... | 2026-11-04 |
| CVE-2023-4853 | high | 8.1 | No | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests... | 2026-11-04 |
| CVE-2026-91532 | high | 8.8 | No | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions tha... | 2026-11-04 |
| CVE-2026-116241 | high | 8.8 | No | pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are... | 2026-11-04 |
| CVE-2026-116239 | high | 8.8 | No | In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and... | 2026-11-04 |
| CVE-2026-116240 | medium | 6.5 | No | In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path w... | 2026-11-04 |
| CVE-2026-76806 | medium | 6.3 | No | Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values f... | 2026-11-04 |
| CVE-2026-122192 | high | 7.5 | No | Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to re... | 2026-11-04 |
| CVE-2026-122118 | high | 7.4 | No | In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient streng... | 2026-11-04 |
| CVE-2026-12109 | high | 7.2 | No | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrat... | 2026-11-04 |
| CVE-2026-121933 | critical | 10.0 | No | A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Se... | 2026-11-04 |
| CVE-2026-122116 | medium | 4.3 | No | Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configu... | 2026-11-04 |
| CVE-2026-121925 | medium | 6.6 | No | A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corr... | 2026-11-04 |
| CVE-2026-121818 | high | 7.8 | No | Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly... | 2026-11-04 |
| CVE-2026-121817 | high | 7.5 | No | Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attacker... | 2026-11-04 |
| CVE-2026-121816 | high | 8.8 | No | Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect... | 2026-11-04 |