Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108050 | not reported | — | No | A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and en... | 2026-11-03 |
| CVE-2026-108049 | not reported | — | No | Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an atta... | 2026-11-03 |
| CVE-2026-108048 | not reported | — | No | Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enfor... | 2026-11-03 |
| CVE-2026-108047 | not reported | — | No | Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properl... | 2026-11-03 |
| CVE-2026-108046 | not reported | — | No | Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By mod... | 2026-11-03 |
| CVE-2026-120572 | high | 8.8 | No | Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1. | 2026-11-03 |
| CVE-2026-65160 | medium | 5.5 | No | NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead... | 2026-11-03 |
| CVE-2026-116958 | medium | 6.7 | No | A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment... | 2026-11-03 |
| CVE-2026-116768 | not reported | — | No | CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a pe... | 2026-11-03 |
| CVE-2026-109261 | high | 7.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when... | 2026-11-03 |
| CVE-2026-121399 | medium | 4.3 | No | FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB c... | 2026-11-03 |
| CVE-2026-119722 | high | 7.8 | No | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation wh... | 2026-11-03 |
| CVE-2026-119371 | medium | 5.5 | No | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit bec... | 2026-11-03 |
| CVE-2026-113900 | high | 7.0 | No | A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Taho... | 2026-11-03 |
| CVE-2026-119374 | high | 7.8 | No | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf pa... | 2026-11-03 |
| CVE-2026-119375 | medium | 5.5 | No | SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by suppl... | 2026-11-03 |
| CVE-2026-119426 | high | 8.8 | No | phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypass... | 2026-11-03 |
| CVE-2026-86977 | high | 7.5 | No | An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to... | 2026-11-03 |
| CVE-2026-86976 | medium | 5.5 | No | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An a... | 2026-11-03 |
| CVE-2026-119429 | medium | 4.3 | No | phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authent... | 2026-11-03 |