Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109848 | medium | 4.2 | No | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled... | 2026-11-04 |
| CVE-2026-108311 | low | 2.7 | No | Tanium addressed an insufficient logging vulnerability in Tanium Server. | 2026-11-04 |
| CVE-2026-108308 | medium | 6.5 | No | Tanium addressed a SQL injection vulnerability in Patch. | 2026-11-04 |
| CVE-2026-10756 | not reported | — | No | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to... | 2026-11-04 |
| CVE-2026-106087 | not reported | — | No | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitra... | 2026-11-04 |
| CVE-2026-110737 | not reported | — | No | The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response he... | 2026-11-04 |
| CVE-2026-105272 | medium | 4.2 | No | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controll... | 2026-11-04 |
| CVE-2026-102813 | not reported | — | No | An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthen... | 2026-11-04 |
| CVE-2026-102812 | not reported | — | No | A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed... | 2026-11-04 |
| CVE-2026-100164 | high | 7.5 | No | Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Accoun... | 2026-11-04 |
| CVE-2026-102789 | not reported | — | No | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox | 2026-11-04 |
| CVE-2026-102788 | not reported | — | No | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox | 2026-11-04 |
| CVE-2024-54505 | high | 8.8 | No | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.... | 2026-11-04 |
| CVE-2024-54465 | critical | 9.8 | No | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privile... | 2026-11-04 |
| CVE-2024-52940 | high | 7.5 | No | AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic... | 2026-11-04 |
| CVE-2024-36978 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->ban... | 2026-11-04 |
| CVE-2024-2961 | high | 7.3 | No | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converti... | 2026-11-04 |
| CVE-2026-86984 | medium | 5.5 | No | A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in mac... | 2026-11-04 |
| CVE-2026-86985 | medium | 6.5 | No | This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPad... | 2026-11-04 |
| CVE-2026-86986 | high | 7.5 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-04 |