NVD / NIST
organizationUS01
roles
Roles this identity holds.
02
operates
Sources this identity operates.
03
references
Other names and identifiers for this entity.
nvdUS nvd@nist.gov
04
assessed vulnerabilities (272,014)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-111375US | critical9.1 | — | ||
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non… | ||||
| CVE-2026-111373US | high7.5 | — | ||
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. Wh… | ||||
| CVE-2026-102764US | critical9.8 | KEV | ||
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Unde… | ||||
| CVE-2026-87029US | high7.5 | — | ||
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the down… | ||||
| CVE-2026-111233US | medium6.1 | — | ||
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded… | ||||
| CVE-2026-111225US | high8.8 | — | ||
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the u… | ||||
| CVE-2026-111222US | high7.2 | — | ||
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unva… | ||||
| CVE-2026-111221US | high7.2 | — | ||
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS s… | ||||
| CVE-2026-111219US | high7.2 | — | ||
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated use… | ||||
| CVE-2026-111125US | high7.1 | — | ||
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_n… | ||||
| CVE-2026-111124US | high7.1 | — | ||
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value… | ||||
| CVE-2026-109932US | high7.5 | — | ||
undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSock… | ||||
| CVE-2026-109924US | high7.5 | — | ||
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust proc… | ||||
| CVE-2026-109829US | critical9.1 | — | ||
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in th… | ||||
| CVE-2026-109383US | critical9.1 | — | ||
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options… | ||||
| CVE-2026-111096US | medium5.4 | — | ||
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible | ||||
| CVE-2026-111095US | medium5.4 | — | ||
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible | ||||
| CVE-2026-111094US | critical9.8 | — | ||
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | ||||
| CVE-2026-44084US | high7.5 | — | ||
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain… | ||||
| CVE-2026-34015US | medium6.5 | — | ||
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of… | ||||