Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120538 | high | 8.1 | No | The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all vers... | 2026-11-03 |
| CVE-2026-116606 | not reported | — | No | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to in... | 2026-11-03 |
| CVE-2026-112697 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-03 |
| CVE-2026-112688 | high | 8.8 | No | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS... | 2026-11-03 |
| CVE-2026-112639 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-03 |
| CVE-2026-112637 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Go... | 2026-11-03 |
| CVE-2026-112626 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-03 |
| CVE-2026-111560 | not reported | — | No | Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Bar... | 2026-11-03 |
| CVE-2026-101757 | high | 7.8 | No | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions tha... | 2026-11-03 |
| CVE-2026-101705 | high | 7.7 | No | Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary). Supported versions that are af... | 2026-11-03 |
| CVE-2026-101676 | high | 7.8 | No | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). Supported versions that are... | 2026-11-03 |
| CVE-2025-9566 | high | 8.1 | No | There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Sec... | 2026-11-03 |
| CVE-2026-17527 | high | 7.7 | No | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources... | 2026-11-03 |
| CVE-2026-79589 | critical | 9.8 | No | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthentic... | 2026-11-03 |
| CVE-2026-61571 | high | 7.3 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpo... | 2026-11-03 |
| CVE-2026-61567 | critical | 10.0 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named stream... | 2026-11-03 |
| CVE-2026-57448 | not reported | — | No | Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET... | 2026-11-03 |
| CVE-2026-55561 | not reported | — | No | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can a... | 2026-11-03 |
| CVE-2026-118585 | low | 3.5 | No | A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809... | 2026-11-03 |
| CVE-2026-118577 | medium | 6.3 | No | A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request For... | 2026-11-03 |