Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 09:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

187-69% vs 7-day avg of 599

2 critical, 69 high, 73 medium, 33 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.3	CVE-2026-96616	Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them... KiloviewKiloview E3 Firmware, Kiloview E3 NDI Encoder	NVD	Oct 22 22:20 UTC
CVE-2026-96616Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them... Executive summary The advisory concerns the Kiloview E3 NDI Encoder, whose firmware versions below 1.30 contain multiple vulnerabilities, including several that allow command execution as root and others that allow unauthenticated access or disruption. The advisory describes successful exploitation as potentially allowing an attacker to fully compromise the device, and the CVE entries carry scores ranging from 5.3 to 9.9 on CVSS v3.1. The vendor recommends updating the firmware to V1.30. Technical summary The flaws include OS command injection (CWE-78) in the network management and system control services, reachable by authenticated web users, with the advisory stating commands run as root and the static route malicious configuration persists across reboots. Other issues include missing authentication on the ONVIF service (CWE-306), hard-coded HMAC-SHA256 secret used to sign session JSON Web Tokens (CWE-798), insufficient session expiration (CWE-613), path traversal via the time zone parameter (CWE-22), and a NULL pointer dereference causing ONVIF service denial of service (CWE-476). Affected firmware is listed as Kiloview E3 Firmware versions less than 1.30, and the fix is update to V1.30. The advisory states no workarounds beyond general network isolation and VPN guidance, and it does not state specific detection signatures. It also states no known public exploitation has been reported to CISA at this time. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cisagov/CSAF/blob/develop/cs…/icsa-26-295-01.json Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Kiloview Kiloview E3 Firmware Kiloview E3 NDI Encoder NIST National Vulnerability DatabasePublished Oct 22, 2026 22:20 UTC Read the advisory
	Medium	6.9	CVE-2026-111100	The ONVIF device service on the E3 responds to certain informational requests without requiring authentication KiloviewKiloview E3 Firmware, Kiloview E3 NDI Encoder	NVD	Oct 22 22:18 UTC
CVE-2026-111100The ONVIF device service on the E3 responds to certain informational requests without requiring authentication Executive summary CISA's advisory ICSA-26-295-01 covers the Kiloview E3 NDI Encoder, whose firmware versions below 1.30 contain multiple vulnerabilities. The advisory says successful exploitation could allow an attacker to fully compromise the device, and several flaws are rated critical. The vendor recommends updating the firmware to V1.30 and, in general, limiting network exposure of control system devices. Technical summary The advisory lists about a dozen CVEs in the E3 firmware, including OS command injection (CWE-78) in the static route and device naming functions that run as root, missing authentication on the ONVIF service (CWE-306), hardcoded HMAC-SHA256 signing secret for session tokens (CWE-798), non-expiring session tokens (CWE-613), path traversal via the time zone parameter (CWE-22), and a NULL pointer dereference causing ONVIF denial of service (CWE-476). The highest listed CVSS v3.1 base score is 9.9 (CVE-2026-107861 and CVE-2026-110243); the stated preconditions vary, with some requiring authenticated web users and others requiring no authentication. Affected versions are stated as less than 1.30, and the fixed version is V1.30. Workarounds beyond updating are not specifically stated, though the advisory gives general guidance to isolate control networks, avoid internet exposure, and use updated VPNs for remote access. No detection guidance specific to these flaws is stated, and the advisory says no known public exploitation has been reported to CISA. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cisagov/CSAF/blob/develop/cs…/icsa-26-295-01.json Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Kiloview Kiloview E3 Firmware Kiloview E3 NDI Encoder NIST National Vulnerability DatabasePublished Oct 22, 2026 22:18 UTC Read the advisory
	Critical	9.4	CVE-2026-109122	The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API KiloviewKiloview E3 Firmware, Kiloview E3 NDI Encoder	NVD	Oct 22 22:17 UTC
CVE-2026-109122The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API Executive summary CISA's advisory ICSA-26-295-01 covers multiple vulnerabilities in Kiloview E3 NDI Encoder firmware earlier than 1.30. The advisory states that successful exploitation could allow an attacker to fully compromise the device, and several flaws are rated critical. The vendor recommends updating the firmware to V1.30. Technical summary The advisory lists about a dozen CVEs, including OS command injection (CWE-78) flaws in the network management and system control services that run commands as root after authenticated web access, a hard-coded HMAC-SHA256 signing secret for session tokens (CWE-798) that can be recovered from public firmware, missing authentication on ONVIF services (CWE-306) that can expose user lists or change hostname, DNS and NTP settings, non-expiring session tokens (CWE-613), path traversal in the time zone parameter (CWE-22), and a NULL pointer dereference in the ONVIF service (CWE-476) that causes temporary denial of service. CVSS v3.1 base scores range from 5.3 to 9.9 as listed. The affected firmware is stated as versions less than 1.30, and the fix is V1.30. The advisory states that no known public exploitation has been reported to CISA, and it does not give detection signatures beyond general monitoring and network isolation guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cisagov/CSAF/blob/develop/cs…/icsa-26-295-01.json Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Kiloview Kiloview E3 Firmware Kiloview E3 NDI Encoder NIST National Vulnerability DatabasePublished Oct 22, 2026 22:17 UTC Read the advisory
	Medium	6.0	CVE-2026-105265	A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a... KiloviewKiloview E3 Firmware, Kiloview E3 NDI Encoder	NVD	Oct 22 22:17 UTC
CVE-2026-105265A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a... Executive summary The advisory covers Kiloview E3 NDI encoder firmware versions below 1.30, which contain multiple vulnerabilities, several of which allow remote or authenticated users to run commands as root and fully compromise the device. CISA rates the overall impact as severe, with individual CVSS scores ranging from 5.3 to 9.9, and the vendor recommends updating the firmware to V1.30. Technical summary The advisory lists many flaws, including OS command injection (CWE-78) in the network management and system control services that allow authenticated web users to run commands as root, hardcoded HMAC secret for JWT signing (CWE-798), missing authentication on ONVIF services (CWE-306), insufficient session expiration (CWE-613), a NULL pointer dereference causing ONVIF denial of service (CWE-476), and a path traversal (CWE-22) in the time zone parameter that lets an authenticated user point /etc/localtime outside the zoneinfo directory. Affected version is stated as less than 1.30, and the fixed version is V1.30. The vendor's only listed remediation is updating to V1.30; no other workarounds are stated. The advisory does not state any detection guidance, and it states that no known public exploitation has been reported to CISA. CISA recommends network segmentation, minimizing exposure, and following its ICS recommended practices. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cisagov/CSAF/blob/develop/cs…/icsa-26-295-01.json Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Kiloview Kiloview E3 Firmware Kiloview E3 NDI Encoder NIST National Vulnerability DatabasePublished Oct 22, 2026 22:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee