Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107049 | high | 7.5 | No | An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI st... | 2026-10-30 |
| CVE-2026-107047 | high | 7.5 | No | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanis... | 2026-10-30 |
| CVE-2026-107044 | high | 7.5 | No | Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAX... | 2026-10-30 |
| CVE-2026-50000 | medium | 5.0 | No | SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communi... | 2026-10-30 |
| CVE-2026-119299 | medium | 5.9 | No | gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled d... | 2026-10-30 |
| CVE-2026-105456 | not reported | — | No | RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the pl... | 2026-10-30 |
| CVE-2026-105455 | not reported | — | No | RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and the... | 2026-10-30 |
| CVE-2026-105454 | not reported | — | No | RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break ou... | 2026-10-30 |
| CVE-2026-93327 | not reported | — | No | A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-... | 2026-10-30 |
| CVE-2026-48164 | medium | 4.7 | No | Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_i... | 2026-10-30 |
| CVE-2026-75882 | not reported | — | No | An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permiss... | 2026-10-30 |
| CVE-2026-85268 | not reported | — | No | A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versio... | 2026-10-30 |
| CVE-2026-116366 | not reported | — | No | An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to... | 2026-10-30 |
| CVE-2026-107239 | not reported | — | No | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers runni... | 2026-10-30 |
| CVE-2026-107238 | not reported | — | No | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running t... | 2026-10-30 |
| CVE-2023-22793 | not reported | — | No | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Exte... | 2026-10-30 |
| CVE-2026-119286 | high | 7.5 | No | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level Validat... | 2026-10-30 |
| CVE-2026-13303 | high | 8.7 | No | HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that ma... | 2026-10-30 |
| CVE-2026-119168 | high | 8.8 | No | HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malic... | 2026-10-30 |
| CVE-2026-118773 | not reported | — | No | Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), Glo... | 2026-10-30 |