Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77053 | not reported | — | No | boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes al... | 2026-11-02 |
| CVE-2026-70381 | medium | 5.3 | No | An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be... | 2026-11-02 |
| CVE-2026-70380 | medium | 5.3 | No | A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauth... | 2026-11-02 |
| CVE-2026-70379 | medium | 6.5 | No | When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP... | 2026-11-02 |
| CVE-2026-71456 | not reported | — | No | Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue aff... | 2026-11-02 |
| CVE-2026-71455 | not reported | — | No | Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive... | 2026-11-02 |
| CVE-2026-77052 | not reported | — | No | boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API... | 2026-11-02 |
| CVE-2026-65626 | not reported | — | No | The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the... | 2026-11-02 |
| CVE-2026-65625 | not reported | — | No | The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itsel... | 2026-11-02 |
| CVE-2026-112655 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-02 |
| CVE-2026-58496 | medium | 4.3 | No | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` f... | 2026-11-02 |
| CVE-2026-58257 | high | 7.2 | No | GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration featu... | 2026-11-02 |
| CVE-2026-57198 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.... | 2026-11-02 |
| CVE-2026-57197 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-57191 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-57195 | high | 7.5 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-57194 | medium | 5.9 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-54462 | medium | 6.5 | No | Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/web... | 2026-11-02 |
| CVE-2026-120497 | medium | 5.0 | No | Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might... | 2026-11-02 |
| CVE-2026-120067 | medium | 5.9 | No | For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copie... | 2026-11-02 |