Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120988 | medium | 6.1 | No | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend templa... | 2026-11-03 |
| CVE-2026-116845 | medium | 5.4 | No | NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to... | 2026-11-03 |
| CVE-2026-115231 | not reported | — | No | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback... | 2026-11-03 |
| CVE-2026-119736 | high | 8.2 | No | Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability tha... | 2026-11-03 |
| CVE-2026-113421 | not reported | — | No | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the modul... | 2026-11-03 |
| CVE-2026-113910 | medium | 5.5 | No | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and... | 2026-11-03 |
| CVE-2026-113906 | medium | 6.5 | No | A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS... | 2026-11-03 |
| CVE-2026-112690 | critical | 10.0 | No | This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macO... | 2026-11-03 |
| CVE-2026-112686 | low | 3.1 | No | A race condition was addressed with improved locking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS... | 2026-11-03 |
| CVE-2026-110826 | not reported | — | No | Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker hol... | 2026-11-03 |
| CVE-2025-71452 | medium | 6.1 | No | Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.... | 2026-11-03 |
| CVE-2026-103653 | not reported | — | No | An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing... | 2026-11-03 |
| CVE-2026-86946 | high | 7.7 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, m... | 2026-11-03 |
| CVE-2026-86970 | medium | 5.5 | No | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS... | 2026-11-03 |
| CVE-2026-80343 | high | 8.2 | No | Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 befor... | 2026-11-03 |
| CVE-2026-80344 | high | 8.2 | No | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5,... | 2026-11-03 |
| CVE-2026-112577 | medium | 5.5 | No | A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitiv... | 2026-11-03 |
| CVE-2026-84176 | medium | 6.5 | No | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apach... | 2026-11-03 |
| CVE-2026-119675 | high | 8.6 | No | MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump.... | 2026-11-03 |
| CVE-2026-119674 | low | 3.7 | No | MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filen... | 2026-11-03 |