Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116658 | medium | 6.5 | No | Tanium addressed a denial of service vulnerability in Enforce. | 2026-11-04 |
| CVE-2026-116649 | high | 7.1 | No | Tanium addressed an improper output sanitization vulnerability in Enforce. | 2026-11-04 |
| CVE-2026-116647 | high | 7.1 | No | Tanium addressed an improper output sanitization vulnerability in Comply. | 2026-11-04 |
| CVE-2026-117861 | critical | 9.6 | No | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunde... | 2026-11-04 |
| CVE-2026-117860 | high | 8.1 | No | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,... | 2026-11-04 |
| CVE-2026-116627 | high | 8.7 | No | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell... | 2026-11-04 |
| CVE-2026-115216 | not reported | — | No | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller AP... | 2026-11-04 |
| CVE-2026-116196 | medium | 5.3 | No | Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE... | 2026-11-04 |
| CVE-2026-116192 | medium | 5.9 | No | rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http a... | 2026-11-04 |
| CVE-2026-116164 | not reported | — | No | Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing... | 2026-11-04 |
| CVE-2026-115326 | medium | 5.4 | No | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest()... | 2026-11-04 |
| CVE-2026-10537 | medium | 5.3 | No | A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users... | 2026-11-04 |
| CVE-2026-113644 | not reported | — | No | In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the... | 2026-11-04 |
| CVE-2026-111497 | critical | 9.8 | Listed | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows... | 2026-11-04 |
| CVE-2026-109619 | high | 8.1 | Listed | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may... | 2026-11-04 |
| CVE-2026-108313 | medium | 6.6 | No | Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. | 2026-11-04 |
| CVE-2026-108309 | medium | 5.5 | No | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. | 2026-11-04 |
| CVE-2026-109088 | medium | 6.5 | No | A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback functio... | 2026-11-04 |
| CVE-2026-108833 | high | 7.5 | No | Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This... | 2026-11-04 |
| CVE-2026-109618 | critical | 9.8 | Listed | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not prope... | 2026-11-04 |