Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58838 | medium | 4.0 | No | In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local... | 2026-11-04 |
| CVE-2026-122148 | not reported | — | No | In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with... | 2026-11-04 |
| CVE-2026-122124 | medium | 6.1 | No | On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interfa... | 2026-11-04 |
| CVE-2026-122120 | critical | 9.0 | No | In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exp... | 2026-11-04 |
| CVE-2026-122054 | medium | 5.9 | No | Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.... | 2026-11-04 |
| CVE-2026-122032 | medium | 6.5 | No | SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQ... | 2026-11-04 |
| CVE-2026-122007 | medium | 6.5 | No | Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site admi... | 2026-11-04 |
| CVE-2026-121967 | medium | 4.9 | No | Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.3... | 2026-11-04 |
| CVE-2026-121966 | high | 8.7 | No | Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an aut... | 2026-11-04 |
| CVE-2026-121965 | medium | 5.3 | No | Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Cod... | 2026-11-04 |
| CVE-2026-121964 | high | 7.5 | No | FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and... | 2026-11-04 |
| CVE-2026-121993 | medium | 4.3 | No | wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route... | 2026-11-04 |
| CVE-2026-121970 | low | 3.7 | No | Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerabilit... | 2026-11-04 |
| CVE-2026-121963 | medium | 5.9 | No | FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers t... | 2026-11-04 |
| CVE-2026-121962 | high | 8.1 | No | FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads dur... | 2026-11-04 |
| CVE-2026-121961 | medium | 5.9 | No | FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A... | 2026-11-04 |
| CVE-2026-121960 | high | 7.5 | No | FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens.... | 2026-11-04 |
| CVE-2026-121959 | medium | 6.5 | No | FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload... | 2026-11-04 |
| CVE-2026-121958 | high | 8.8 | No | FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys t... | 2026-11-04 |
| CVE-2026-121957 | high | 7.5 | No | FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGF... | 2026-11-04 |