CVE-2026-109122: DHS
- Severity
- 9.4 (CRITICAL)
- Vendor
- DHS
- Patch status
- Unknown
- Published
- 2026-10-22T22:17:59.930
- Modified
- 2026-10-22T22:17:59.930
Why it matters
Critical vulnerability requiring immediate validation against your environment.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Treat internet-facing systems as higher priority.
Technical summary
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
View the official NVD record for CVE-2026-109122
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
493 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-110264 |
GitLab PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-102785 |
YOOtheme Pro extension for Joomla
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79844 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79846 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79847 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79848 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79849 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79850 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79851 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-110063 |
VM Inspector for Azure Virtual Machines
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-83938 |
Azure Kubernetes Configuration Service
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97785 |
Microsoft Entra application proxy
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-114612 |
litellm PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-112241 |
SureCart PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-112832 |
Rootblox PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79852 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79853 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79854 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79855 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79856 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79857 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79858 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79859 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79860 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79861 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79862 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79863 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79864 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79865 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79866 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79867 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79868 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79869 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79870 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79871 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-97631 |
EDK2
Reporter: INFOSEC
|
9.5
CRITICAL
|
VIEW RECORD |
| CVE-2026-115375 |
Incus 7.0.0 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-115377 |
Incus PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-115384 |
Wasmtime 39.0.0 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-79872 |
HPE
Reporter: SECURITY-ALERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-114625 |
VeloCloud Orchestrator (VCO) on-prem
Reporter: PSIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-109122 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-107861 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-110243 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-114575 |
A950RG
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114220 |
NT OneAPP developed by NewType Infortech
Reporter: TWCERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112327 |
Amelia PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48014 |
FineReport 9.0
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48016 |
DedeCMS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2022-51026 |
Bytebase 0.12.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79873 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79874 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79875 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79876 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-115324 |
mem0 0.1.117 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111497 |
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-115353 |
Mistune PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111594 |
InterSystems IRIS for Health
Reporter: ICS-CERT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-96355 |
Webform
Reporter: MLHESS
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114219 |
NT OneAPP developed by NewType Infortech
Reporter: TWCERT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114607 |
better-auth PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114611 |
OCO-Server PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-105014 |
a command ('command injection') in Azure Pipelines
Reporter: SECURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114661 |
OpenRemote 1.2.0 PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-115372 |
Incus from 7.3.0 PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-114177 |
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112242 |
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2019-25778 |
SeaCMS
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51021 |
NotificationX PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51022 |
YiShaAdmin 2.2 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51023 |
PHPOK 4.5.000 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2024-58393 |
Readymade Unilevel Ecommerce MLM
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2025-71434 |
Weaver E-cology 8.0, 9.0, and 10.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108357 |
PhpSpreadsheet PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108358 |
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115392 |
Wasmtime PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79877 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79878 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79879 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114658 |
Grav Login plugin from 3.6.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105270 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-93471 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2017-20287 |
Javo Spot PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25438 |
Intermesh Group-Office 3.3.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25439 |
MetInfo CMS 6.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2019-25779 |
WooThemes Diarise
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48013 |
Weaver E-cology 8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48015 |
JeeWMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48017 |
OrbiTeam BSCW Server 5.x PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2022-51024 |
Kavita 0.5.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58396 |
CPAS Audit Management System
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115325 |
Netmaker
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115328 |
JSON-SCADA PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115330 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115331 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115332 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113582 |
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-108359 |
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113873 |
HAPI FHIR
Reporter: 9119A7D8-5EAB-497F-8521-727C672E3725
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115347 |
Mistune PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.