Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-42170 | high | 7.8 | No | A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9... | 2026-11-04 |
| CVE-2026-45144 | high | 8.9 | No | Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and render... | 2026-11-04 |
| CVE-2026-44344 | medium | 6.6 | No | Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` c... | 2026-11-04 |
| CVE-2026-43961 | high | 7.8 | No | A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted... | 2026-11-04 |
| CVE-2026-42784 | high | 7.4 | No | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing,... | 2026-11-04 |
| CVE-2026-42010 | critical | 9.8 | No | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing... | 2026-11-04 |
| CVE-2026-42009 | high | 7.5 | No | A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic... | 2026-11-04 |
| CVE-2026-3012 | medium | 6.8 | No | A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrie... | 2026-11-04 |
| CVE-2026-35093 | high | 8.8 | No | A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration d... | 2026-11-04 |
| CVE-2026-34003 | high | 7.8 | No | A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X... | 2026-11-04 |
| CVE-2026-34001 | high | 7.8 | No | A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within th... | 2026-11-04 |
| CVE-2026-33999 | high | 7.8 | No | A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an... | 2026-11-04 |
| CVE-2026-33846 | high | 7.5 | No | A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_p... | 2026-11-04 |
| CVE-2026-33845 | critical | 9.1 | No | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow dur... | 2026-11-04 |
| CVE-2026-26158 | high | 7.0 | No | A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting... | 2026-11-04 |
| CVE-2026-28369 | critical | 9.1 | No | A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrec... | 2026-11-04 |
| CVE-2026-28368 | critical | 9.1 | No | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are par... | 2026-11-04 |
| CVE-2026-28367 | critical | 9.1 | No | A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be... | 2026-11-04 |
| CVE-2026-19685 | high | 7.1 | No | NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. T... | 2026-11-04 |
| CVE-2026-26103 | high | 7.1 | No | A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without p... | 2026-11-04 |