Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62968 | not reported | — | No | Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence argum... | 2026-11-02 |
| CVE-2026-62958 | high | 7.9 | No | libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory::... | 2026-11-02 |
| CVE-2026-62849 | critical | 9.1 | No | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows r... | 2026-11-02 |
| CVE-2026-62847 | high | 8.2 | No | Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Frame... | 2026-11-02 |
| CVE-2026-62300 | medium | 6.5 | No | Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including ve... | 2026-11-02 |
| CVE-2026-62297 | high | 7.5 | No | ag-psd is a JavaScript library for reading and writing Photoshop Document files. Before the allocation-limit remediation attempt in version... | 2026-11-02 |
| CVE-2026-62254 | medium | 5.5 | No | LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource... | 2026-11-02 |
| CVE-2026-62250 | medium | 5.5 | No | LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `... | 2026-11-02 |
| CVE-2026-62337 | not reported | — | No | SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point... | 2026-11-02 |
| CVE-2026-62334 | not reported | — | No | OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.... | 2026-11-02 |
| CVE-2026-62302 | not reported | — | No | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes`... | 2026-11-02 |
| CVE-2026-62284 | not reported | — | No | OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Ku... | 2026-11-02 |
| CVE-2026-55598 | critical | 9.1 | No | PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an att... | 2026-11-02 |
| CVE-2026-55098 | medium | 6.5 | No | Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026... | 2026-11-02 |
| CVE-2026-119331 | high | 7.1 | No | Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRul... | 2026-11-02 |
| CVE-2026-81938 | high | 7.7 | No | Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTT... | 2026-11-02 |
| CVE-2026-119301 | high | 7.9 | No | Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also p... | 2026-11-02 |
| CVE-2026-106804 | high | 7.5 | No | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the at... | 2026-11-02 |
| CVE-2026-105769 | critical | 9.3 | No | kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry ho... | 2026-11-02 |
| CVE-2026-120491 | medium | 5.4 | No | Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject scrip... | 2026-11-02 |