Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105980 | high | 7.2 | No | Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execu... | 2026-11-03 |
| CVE-2026-105979 | high | 7.2 | No | Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execut... | 2026-11-03 |
| CVE-2026-120833 | high | 7.8 | No | labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with... | 2026-11-03 |
| CVE-2026-29508 | high | 8.8 | No | ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers... | 2026-11-03 |
| CVE-2026-119739 | medium | 5.3 | No | The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes,... | 2026-11-03 |
| CVE-2026-119737 | high | 7.8 | No | The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command in... | 2026-11-03 |
| CVE-2026-117082 | not reported | — | No | An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU devi... | 2026-11-03 |
| CVE-2026-86896 | high | 7.8 | No | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS T... | 2026-11-03 |
| CVE-2026-121554 | medium | 5.9 | No | cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts be... | 2026-11-03 |
| CVE-2026-121550 | low | 3.3 | No | nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an ex... | 2026-11-03 |
| CVE-2026-118487 | high | 7.5 | No | In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `max... | 2026-11-03 |
| CVE-2026-86939 | medium | 4.9 | No | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attack... | 2026-11-03 |
| CVE-2026-109260 | high | 7.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when... | 2026-11-03 |
| CVE-2026-119742 | high | 7.2 | No | Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.ph... | 2026-11-03 |
| CVE-2026-105476 | high | 8.8 | No | Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate pri... | 2026-11-03 |
| CVE-2026-105475 | not reported | — | No | Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. | 2026-11-03 |
| CVE-2026-120689 | not reported | — | No | HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree... | 2026-11-03 |
| CVE-2026-116890 | high | 7.3 | No | Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthen... | 2026-11-03 |
| CVE-2026-112350 | high | 7.5 | No | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote a... | 2026-11-03 |
| CVE-2026-112351 | high | 8.8 | No | Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated r... | 2026-11-03 |