CVE-2026-116014: open62541
- Severity
- 9.2 (CRITICAL)
- Vendor
- OPEN62541
- Affected versions
- 1.5.0 through before 1.5.7
- Fixed version
- 1.5.7
- Patch status
- Patched
- Published
- 2026-10-24T12:16:57.607
- Modified
- 2026-10-24T12:16:57.607
Why it matters
This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Compare installed versions against the affected version range in the advisory.
- Treat internet-facing systems as higher priority.
Technical summary
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
View the official NVD record for CVE-2026-116014
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
110 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-115889 |
wasmtime PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-115893 |
wasmtime PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-115931 |
postiz-app
Reporter: 4CDC9741-F887-419A-A2FD-ACBBD2729276
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-115933 |
postiz-app
Reporter: 4CDC9741-F887-419A-A2FD-ACBBD2729276
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-115806 |
Prime Mover – Backup and Migration
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110956 |
asVereinbase PATCH
Reporter: CONTACT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-114196 |
Paytium PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-94075 |
Newsletters PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-115932 |
postiz-app
Reporter: 4CDC9741-F887-419A-A2FD-ACBBD2729276
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-115557 |
CPython
Reporter: CNA
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-111402 |
Newsletters PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112866 |
Product Filter by WBW PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116014 |
open62541 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114820 |
Oracle Java SE
Reporter: SECALERT_US
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-79982 |
zephyr
Reporter: VULNERABILITIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115895 |
happy-dom PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-110018 |
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115775 |
twisted PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115935 |
cms
Reporter: 7004884B-51E2-48E8-B4A2-5CA29E80453E
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115937 |
commerce-mollie
Reporter: 7004884B-51E2-48E8-B4A2-5CA29E80453E
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115938 |
cms
Reporter: 7004884B-51E2-48E8-B4A2-5CA29E80453E
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116009 |
Camaleon CMS PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116011 |
Crow PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116019 |
Grav 2.0.15 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-58202 |
appointment-booking-software
Reporter: SECURITY-ADVISORIES
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-79977 |
zephyr
Reporter: VULNERABILITIES
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-79979 |
zephyr
Reporter: VULNERABILITIES
|
7.8
HIGH
|
VIEW RECORD |
| CVE-2026-115929 |
Compass
Reporter: CNA
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-19741 |
zephyr
Reporter: VULNERABILITIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-115776 |
twisted PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-115778 |
twisted PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-65825 |
appointment-booking-software
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-115887 |
graphql-scalars PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-114191 |
UPI QR Code Payment Gateway for WooCommerce PATCH
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-65824 |
appointment-booking-software PATCH
Reporter: SECURITY-ADVISORIES
|
7.4
HIGH
|
VIEW RECORD |
| CVE-2026-113673 |
GeoDirectory PATCH
Reporter: CONTACT
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-114704 |
Relevanssi PATCH
Reporter: AUDIT
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-115572 |
pypdf PATCH
Reporter: SECURITY-ADVISORIES
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-115580 |
pypdf PATCH
Reporter: SECURITY-ADVISORIES
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-115585 |
pypdf PATCH
Reporter: SECURITY-ADVISORIES
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-115586 |
virtualenv PATCH
Reporter: SECURITY-ADVISORIES
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-115807 |
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Reporter: SECURITY
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112207 |
Download Monitor PATCH
Reporter: CONTACT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112844 |
WP Event Solution PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112869 |
We’re Open! PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-114178 |
W3 Total Cache PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-114179 |
BP Better Messages PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-114694 |
Events Manager PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-114695 |
VOD Infomaniak PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-114697 |
QA Analytics PATCH
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-115975 |
cervantes PATCH
Reporter: 772F0079-75C2-41CA-913E-D9072716578B
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-116016 |
yudao-cloud
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-115972 |
Faveo Helpdesk
Reporter: CNA
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-115973 |
Faveo Helpdesk
Reporter: CNA
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-105199 |
Pixel Tag Manager for WooCommerce PATCH
Reporter: CONTACT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-113493 |
GeoDirectory PATCH
Reporter: CONTACT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-114429 |
WPVR PATCH
Reporter: CONTACT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-108013 |
BigFix Platform uses Mozilla CA certificate bundle (PEM) PATCH
Reporter: PSIRT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-115993 |
cervantes PATCH
Reporter: 772F0079-75C2-41CA-913E-D9072716578B
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-79981 |
ZEPHYRPROJECT
Reporter: VULNERABILITIES
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-115886 |
mlflow PATCH
Reporter: SECURITY-ADVISORIES
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-107907 |
MAS Videos
Reporter: CONTACT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-87835 |
Front End Users
Reporter: CONTACT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110892 |
Missing Authorization vulnerability in Brainstorm Force SureDash suredash
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-114693 |
Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-114194 |
Igor Funa Ad Inserter ad-inserter
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-114705 |
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-114192 |
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-113491 |
GeoDirectory PATCH
Reporter: CONTACT
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-116013 |
OpenResty lua-resty-dns PATCH
Reporter: DISCLOSURE
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-115883 |
langgraph PATCH
Reporter: SECURITY-ADVISORIES
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-114190 |
Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache
Reporter: AUDIT
|
5.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-115892 |
wasmtime PATCH
Reporter: SECURITY-ADVISORIES
|
5.7
MEDIUM
|
VIEW RECORD |
| CVE-2026-79980 |
zephyr
Reporter: VULNERABILITIES
|
5.6
MEDIUM
|
VIEW RECORD |
| CVE-2026-115969 |
A flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-115970 |
Opptrix
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-115971 |
denial of service. The attack can be initiated remotely. The exploit
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-115877 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+ PATCH
Reporter: SECURITY-ADVISORIES
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-75524 |
appointment-booking-software PATCH
Reporter: SECURITY-ADVISORIES
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-107887 |
Advanced Twenty Seventeen
Reporter: CONTACT
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-97353 |
News Kit Addons For Elementor
Reporter: CONTACT
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-115994 |
cervantes PATCH
Reporter: 772F0079-75C2-41CA-913E-D9072716578B
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-75525 |
appointment-booking-software
Reporter: SECURITY-ADVISORIES
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-113490 |
GeoDirectory PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-113492 |
GeoDirectory PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-116008 |
DaybydayCRM
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-116010 |
RosarioSIS PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-116015 |
yudao-cloud
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-116017 |
Xiaozhi-esp32-server PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-116018 |
ONEARMY community-platform PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-116020 |
BookStack PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-115774 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+ PATCH
Reporter: SECURITY-ADVISORIES
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-113489 |
GeoDirectory PATCH
Reporter: CONTACT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-97352 |
News Kit Addons For Elementor PATCH
Reporter: CONTACT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-115998 |
cervantes PATCH
Reporter: 772F0079-75C2-41CA-913E-D9072716578B
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-115885 |
verbose mode. Anyone who can read resulting CI logs or terminal recordings PATCH
Reporter: SECURITY-ADVISORIES
|
4.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-113674 |
GeoDirectory PATCH
Reporter: CONTACT
|
3.7
LOW
|
VIEW RECORD |
| CVE-2026-79978 |
ZEPHYRPROJECT
Reporter: VULNERABILITIES
|
3.6
LOW
|
VIEW RECORD |
| CVE-2026-83813 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+ PATCH
Reporter: SECURITY-ADVISORIES
|
3.1
LOW
|
VIEW RECORD |
| CVE-2026-115797 |
F6
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.