Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93846 | low | 3.8 | No | Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a tea... | 2026-11-02 |
| CVE-2026-90723 | low | 2.7 | No | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1... | 2026-11-02 |
| CVE-2026-90719 | low | 2.7 | No | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1... | 2026-11-02 |
| CVE-2026-90727 | low | 3.8 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-11-02 |
| CVE-2026-84599 | high | 7.8 | No | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Gold... | 2026-11-02 |
| CVE-2026-77817 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitizati... | 2026-11-02 |
| CVE-2026-77057 | not reported | — | No | boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password com... | 2026-11-02 |
| CVE-2026-77055 | not reported | — | No | boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in... | 2026-11-02 |
| CVE-2026-77053 | not reported | — | No | boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes al... | 2026-11-02 |
| CVE-2026-70381 | medium | 5.3 | No | An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be... | 2026-11-02 |
| CVE-2026-70380 | medium | 5.3 | No | A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauth... | 2026-11-02 |
| CVE-2026-70379 | medium | 6.5 | No | When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP... | 2026-11-02 |
| CVE-2026-71456 | not reported | — | No | Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue aff... | 2026-11-02 |
| CVE-2026-71455 | not reported | — | No | Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive... | 2026-11-02 |
| CVE-2026-77052 | not reported | — | No | boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API... | 2026-11-02 |
| CVE-2026-65626 | not reported | — | No | The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the... | 2026-11-02 |
| CVE-2026-65625 | not reported | — | No | The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itsel... | 2026-11-02 |
| CVE-2026-112655 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-02 |
| CVE-2026-58496 | medium | 4.3 | No | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` f... | 2026-11-02 |
| CVE-2026-58257 | high | 7.2 | No | GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration featu... | 2026-11-02 |