Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107033 | medium | 6.5 | No | Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbit... | 2026-11-03 |
| CVE-2026-107027 | critical | 9.1 | No | Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading... | 2026-11-03 |
| CVE-2026-107021 | critical | 9.1 | No | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attacker... | 2026-11-03 |
| CVE-2026-107016 | high | 7.5 | No | Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | 2026-11-03 |
| CVE-2026-112492 | high | 7.0 | No | A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe... | 2026-11-03 |
| CVE-2026-4405 | low | 3.3 | No | IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system. | 2026-11-03 |
| CVE-2026-112487 | high | 7.8 | No | A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tah... | 2026-11-03 |
| CVE-2026-4413 | medium | 6.1 | No | IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrar... | 2026-11-03 |
| CVE-2026-6719 | high | 7.5 | No | IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in... | 2026-11-03 |
| CVE-2026-107366 | high | 8.3 | No | IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bu... | 2026-11-03 |
| CVE-2026-112414 | medium | 6.5 | No | A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2... | 2026-11-03 |
| CVE-2026-112479 | medium | 5.2 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS... | 2026-11-03 |
| CVE-2026-86988 | medium | 4.3 | No | The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 2... | 2026-11-03 |
| CVE-2026-91899 | medium | 6.4 | No | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability... | 2026-11-03 |
| CVE-2026-91895 | high | 7.1 | No | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged... | 2026-11-03 |
| CVE-2026-58873 | high | 8.4 | No | In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lea... | 2026-11-03 |
| CVE-2026-59000 | high | 8.4 | No | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with... | 2026-11-03 |
| CVE-2026-58984 | high | 8.4 | No | In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with... | 2026-11-03 |
| CVE-2026-58970 | high | 8.4 | No | In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local e... | 2026-11-03 |
| CVE-2026-58965 | high | 8.4 | No | In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to loca... | 2026-11-03 |