Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-10649 | high | 8.6 | No | A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decomp... | 2026-11-04 |
| CVE-2026-10118 | high | 7.8 | No | A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when... | 2026-11-04 |
| CVE-2026-108949 | medium | 6.5 | No | Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for... | 2026-11-04 |
| CVE-2026-109411 | high | 8.1 | No | An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass acce... | 2026-11-04 |
| CVE-2026-109832 | high | 7.5 | No | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUT... | 2026-11-04 |
| CVE-2026-108094 | high | 7.8 | No | A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicio... | 2026-11-04 |
| CVE-2026-105958 | high | 7.5 | No | A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without... | 2026-11-04 |
| CVE-2026-105959 | high | 7.5 | No | A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc... | 2026-11-04 |
| CVE-2026-104715 | high | 7.8 | No | A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mount... | 2026-11-04 |
| CVE-2026-107935 | critical | 9.3 | No | A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /se... | 2026-11-04 |
| CVE-2026-106062 | high | 7.8 | No | A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived fro... | 2026-11-04 |
| CVE-2026-104988 | high | 8.1 | No | A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is subm... | 2026-11-04 |
| CVE-2026-103002 | high | 8.8 | No | GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver... | 2026-11-04 |
| CVE-2026-102895 | critical | 9.8 | No | GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpust... | 2026-11-04 |
| CVE-2026-102894 | critical | 9.1 | No | GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/ca... | 2026-11-04 |
| CVE-2026-103963 | high | 7.5 | No | A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session... | 2026-11-04 |
| CVE-2026-102560 | critical | 9.8 | No | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calcul... | 2026-11-04 |
| CVE-2026-102559 | high | 8.6 | No | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByt... | 2026-11-04 |
| CVE-2026-102558 | high | 8.6 | No | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray bas... | 2026-11-04 |
| CVE-2026-102555 | high | 8.2 | No | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings... | 2026-11-04 |