Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2023-1916 | medium | 6.1 | No | A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read... | 2026-11-02 |
| CVE-2023-1077 | high | 7.0 | No | In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wil... | 2026-11-02 |
| CVE-2023-21528 | high | 7.8 | No | Microsoft SQL Server Remote Code Execution Vulnerability | 2026-11-02 |
| CVE-2022-41083 | high | 7.8 | No | Visual Studio Code Elevation of Privilege Vulnerability | 2026-11-02 |
| CVE-2022-41042 | high | 7.4 | No | Visual Studio Code Information Disclosure Vulnerability | 2026-11-02 |
| CVE-2022-40755 | medium | 5.5 | No | JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c. | 2026-11-02 |
| CVE-2022-36280 | medium | 5.5 | No | An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linu... | 2026-11-02 |
| CVE-2022-38533 | medium | 5.5 | No | In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in st... | 2026-11-02 |
| CVE-2022-34717 | high | 8.8 | No | Microsoft Office Remote Code Execution Vulnerability | 2026-11-02 |
| CVE-2026-86596 | critical | 9.8 | No | The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name'... | 2026-11-02 |
| CVE-2026-70382 | medium | 4.1 | No | Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker wh... | 2026-11-02 |
| CVE-2026-85297 | not reported | — | No | Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access propri... | 2026-11-02 |
| CVE-2026-65632 | not reported | — | No | The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature... | 2026-11-02 |
| CVE-2026-65630 | not reported | — | No | Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side chan... | 2026-11-02 |
| CVE-2026-65629 | not reported | — | No | Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-... | 2026-11-02 |
| CVE-2026-65628 | not reported | — | No | jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function cla... | 2026-11-02 |
| CVE-2026-65627 | not reported | — | No | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to... | 2026-11-02 |
| CVE-2026-34121 | high | 8.8 | No | An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was... | 2026-11-02 |
| CVE-2026-116671 | not reported | — | No | Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image. | 2026-11-02 |
| CVE-2026-115748 | high | 8.8 | No | **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XE... | 2026-11-02 |