Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116151 | low | 3.7 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when p... | 2026-11-03 |
| CVE-2026-116150 | low | 3.1 | No | ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a c... | 2026-11-03 |
| CVE-2026-116147 | low | 3.7 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory... | 2026-11-03 |
| CVE-2026-116146 | low | 3.7 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when p... | 2026-11-03 |
| CVE-2026-109266 | low | 3.6 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly esc... | 2026-11-03 |
| CVE-2026-109267 | medium | 5.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fa... | 2026-11-03 |
| CVE-2026-97072 | medium | 4.3 | No | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This iss... | 2026-11-03 |
| CVE-2026-97350 | not reported | — | No | Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow no... | 2026-11-03 |
| CVE-2026-96740 | medium | 6.5 | No | A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are co... | 2026-11-03 |
| CVE-2026-84605 | low | 3.3 | No | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadO... | 2026-11-03 |
| CVE-2026-84594 | medium | 5.5 | No | A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An ap... | 2026-11-03 |
| CVE-2026-63494 | not reported | — | No | Rejected reason: This CVE is a duplicate of another CVE. | 2026-11-03 |
| CVE-2026-76166 | medium | 4.3 | No | A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a v... | 2026-11-03 |
| CVE-2026-65631 | not reported | — | No | Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by s... | 2026-11-03 |
| CVE-2026-63492 | not reported | — | No | Rejected reason: This CVE is a duplicate of another CVE. | 2026-11-03 |
| CVE-2026-63436 | medium | 6.1 | No | zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destina... | 2026-11-03 |
| CVE-2026-44265 | high | 7.4 | No | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from J... | 2026-11-03 |
| CVE-2026-40652 | not reported | — | No | An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevi... | 2026-11-03 |
| CVE-2026-121627 | medium | 6.1 | No | buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute... | 2026-11-03 |
| CVE-2026-121625 | low | 3.7 | No | GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP pe... | 2026-11-03 |