Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108015 | not reported | — | No | Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts cer... | 2026-11-04 |
| CVE-2026-108014 | not reported | — | No | Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts cer... | 2026-11-04 |
| CVE-2026-106077 | not reported | — | No | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with... | 2026-11-04 |
| CVE-2026-106076 | not reported | — | No | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backu... | 2026-11-04 |
| CVE-2026-107590 | not reported | — | No | An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and ea... | 2026-11-04 |
| CVE-2026-104203 | high | 7.5 | No | Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty... | 2026-11-04 |
| CVE-2026-104895 | high | 7.5 | No | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] b... | 2026-11-04 |
| CVE-2026-104016 | high | 7.5 | No | ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) | 2026-11-04 |
| CVE-2026-103995 | not reported | — | No | Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response co... | 2026-11-04 |
| CVE-2026-105477 | not reported | — | No | A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Repl... | 2026-11-04 |
| CVE-2026-104381 | not reported | — | No | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positio... | 2026-11-04 |
| CVE-2026-102664 | high | 7.1 | No | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/m... | 2026-11-04 |
| CVE-2026-102816 | not reported | — | No | An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on t... | 2026-11-04 |
| CVE-2026-102638 | high | 7.1 | No | A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the... | 2026-11-04 |
| CVE-2026-102637 | high | 7.1 | No | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can t... | 2026-11-04 |
| CVE-2026-103594 | not reported | — | No | A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the... | 2026-11-04 |
| CVE-2026-102800 | not reported | — | No | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote() was applied on insert, which protects the SQ... | 2026-11-04 |
| CVE-2026-102340 | high | 8.5 | No | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on po... | 2026-11-04 |
| CVE-2026-102339 | high | 8.2 | No | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC st... | 2026-11-04 |
| CVE-2026-102636 | high | 7.1 | No | A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cr... | 2026-11-04 |