Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116736 | medium | 6.1 | No | Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's... | 2026-10-31 |
| CVE-2026-116732 | medium | 4.4 | No | libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset whe... | 2026-10-31 |
| CVE-2026-116728 | medium | 5.5 | No | libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist... | 2026-10-31 |
| CVE-2026-116724 | high | 7.8 | No | FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation fr... | 2026-10-31 |
| CVE-2026-116589 | not reported | — | No | Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly... | 2026-10-31 |
| CVE-2026-116585 | not reported | — | No | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En... | 2026-10-31 |
| CVE-2026-116581 | high | 7.5 | No | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJ... | 2026-10-31 |
| CVE-2026-116508 | critical | 10.0 | No | A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file... | 2026-10-31 |
| CVE-2026-116577 | medium | 5.3 | No | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line fold... | 2026-10-31 |
| CVE-2026-116505 | critical | 9.1 | No | A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcp... | 2026-10-31 |
| CVE-2026-116542 | medium | 5.3 | No | Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter... | 2026-10-31 |
| CVE-2026-116538 | medium | 4.7 | No | HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(s... | 2026-10-31 |
| CVE-2026-116488 | medium | 6.8 | No | NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class... | 2026-10-31 |
| CVE-2026-116482 | low | 3.5 | No | A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is a... | 2026-10-31 |
| CVE-2026-116477 | medium | 4.3 | No | A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcPro... | 2026-10-31 |
| CVE-2026-116471 | medium | 4.3 | No | A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the c... | 2026-10-31 |
| CVE-2026-116461 | medium | 4.3 | No | A vulnerability was determined in Omega Solution Restro POS up to 20261026. This impacts an unknown function of the file /sale-invoice/. Exe... | 2026-10-31 |
| CVE-2026-116369 | medium | 6.3 | No | A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the fil... | 2026-10-31 |
| CVE-2026-116340 | medium | 4.3 | No | A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the f... | 2026-10-31 |
| CVE-2026-116283 | medium | 4.3 | No | A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. Thi... | 2026-10-31 |