Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116196 | medium | 5.3 | No | Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE... | 2026-11-04 |
| CVE-2026-116192 | medium | 5.9 | No | rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http a... | 2026-11-04 |
| CVE-2026-116164 | not reported | — | No | Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing... | 2026-11-04 |
| CVE-2026-115326 | medium | 5.4 | No | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest()... | 2026-11-04 |
| CVE-2026-10537 | medium | 5.3 | No | A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users... | 2026-11-04 |
| CVE-2026-113644 | not reported | — | No | In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the... | 2026-11-04 |
| CVE-2026-111497 | critical | 9.8 | Listed | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows... | 2026-11-04 |
| CVE-2026-108313 | medium | 6.6 | No | Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. | 2026-11-04 |
| CVE-2026-108309 | medium | 5.5 | No | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. | 2026-11-04 |
| CVE-2026-109088 | medium | 6.5 | No | A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback functio... | 2026-11-04 |
| CVE-2026-108833 | high | 7.5 | No | Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This... | 2026-11-04 |
| CVE-2026-108304 | high | 7.8 | No | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | 2026-11-04 |
| CVE-2026-108141 | not reported | — | No | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to w... | 2026-11-04 |
| CVE-2026-107671 | not reported | — | No | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally bef... | 2026-11-04 |
| CVE-2026-106078 | not reported | — | No | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses... | 2026-11-04 |
| CVE-2026-105987 | not reported | — | No | KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker c... | 2026-11-04 |
| CVE-2026-105323 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications... | 2026-11-04 |
| CVE-2026-107362 | high | 7.1 | No | The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the res... | 2026-11-04 |
| CVE-2025-64394 | not reported | — | No | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup... | 2026-11-04 |
| CVE-2026-112595 | high | 7.5 | No | This issue was addressed with improved authentication. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. A... | 2026-11-04 |