Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54372 | high | 8.8 | No | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows ne... | 2026-11-04 |
| CVE-2026-39743 | medium | 5.3 | No | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access C... | 2026-11-04 |
| CVE-2026-38595 | critical | 9.8 | No | An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted file... | 2026-11-04 |
| CVE-2026-1761 | high | 8.6 | No | A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an... | 2026-11-04 |
| CVE-2026-1933 | medium | 6.5 | No | A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access... | 2026-11-04 |
| CVE-2026-18157 | high | 7.8 | No | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injectio... | 2026-11-04 |
| CVE-2026-1584 | high | 7.5 | No | A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello mes... | 2026-11-04 |
| CVE-2026-18453 | high | 7.5 | No | A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthent... | 2026-11-04 |
| CVE-2026-18355 | high | 7.5 | No | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-re... | 2026-11-04 |
| CVE-2026-16529 | high | 7.5 | No | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negoti... | 2026-11-04 |
| CVE-2026-16526 | high | 8.8 | No | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to... | 2026-11-04 |
| CVE-2026-16527 | high | 7.3 | No | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows th... | 2026-11-04 |
| CVE-2026-17615 | high | 7.5 | No | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote fi... | 2026-11-04 |
| CVE-2026-18147 | high | 8.1 | No | A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/... | 2026-11-04 |
| CVE-2026-16524 | high | 7.8 | No | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This fai... | 2026-11-04 |
| CVE-2026-16493 | high | 7.8 | No | A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git... | 2026-11-04 |
| CVE-2026-16445 | high | 7.5 | No | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP opt... | 2026-11-04 |
| CVE-2026-16460 | high | 7.4 | No | A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against... | 2026-11-04 |
| CVE-2026-15722 | high | 7.5 | No | A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copie... | 2026-11-04 |
| CVE-2026-14544 | critical | 9.8 | No | A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a rem... | 2026-11-04 |