Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates
16,156 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.
CVE-2026-107032
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:26:06.551Z.
CVE-2026-107033
Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:26:55.984Z.
CVE-2026-107034
Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:27:52.543Z.
CVE-2026-107035
Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:38:25.601Z.
CVE-2026-107036
Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:39:20.045Z.
CVE-2026-107037
Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:40:13.291Z.
CVE-2026-107038
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:41:06.907Z.
CVE-2026-107039
Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:41:54.198Z.
CVE-2026-107040
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:48:01.798Z.
CVE-2026-107041
Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T15:48:59.443Z.
CVE-2026-107042
Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T16:00:43.634Z.
CVE-2026-79589
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once t…
Unscored under this view's policy Not listed in this KEV snapshot. EPSS unavailable for this snapshot.
Published 2026-10-29T00:00:00.000Z. Updated 2026-10-29T14:02:04.041Z.
nschloe meshio VTK Reader _vtk_42.py memory allocation
A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the pr…
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T23:45:18.675Z. Updated 2026-10-28T23:45:18.675Z.
dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue repor…
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T23:30:17.619Z. Updated 2026-10-28T23:30:17.619Z.
configuroweb inventariobasico Add Product addlist.php cross site scripting
A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripti…
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T23:15:19.868Z. Updated 2026-10-28T23:15:19.868Z.
CVE-2026-86983
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T23:01:59.598Z. Updated 2026-10-28T23:02:44.171Z.
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made a…
Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T23:00:15.627Z. Updated 2026-10-28T23:00:15.627Z.
maotoumao MusicFreeDesktop Request Forwarder information disclosure
A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public an…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T22:45:10.175Z. Updated 2026-10-29T15:51:30.534Z.
Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `hi…
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T22:40:13.728Z. Updated 2026-10-28T22:40:13.728Z.
MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message `id` to `mailscanner…
Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-28T22:37:38.513Z. Updated 2026-10-29T14:46:47.666Z.