Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62055 | medium | 4.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Co... | 2026-10-30 |
| CVE-2026-62141 | medium | 5.4 | No | Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-30 |
| CVE-2026-59562 | critical | 9.8 | No | Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Use... | 2026-10-30 |
| CVE-2026-58663 | critical | 9.8 | No | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.1... | 2026-10-30 |
| CVE-2026-53918 | not reported | — | No | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a pe... | 2026-10-30 |
| CVE-2026-42057 | high | 7.5 | No | An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .... | 2026-10-30 |
| CVE-2026-41216 | high | 7.5 | No | An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .p... | 2026-10-30 |
| CVE-2026-41114 | high | 7.5 | No | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before... | 2026-10-30 |
| CVE-2026-15816 | high | 7.5 | No | A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook dire... | 2026-10-30 |
| CVE-2026-119479 | medium | 5.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allo... | 2026-10-30 |
| CVE-2026-119482 | medium | 5.3 | No | Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-30 |
| CVE-2026-119367 | medium | 5.4 | No | Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configur... | 2026-10-30 |
| CVE-2026-119365 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Eleme... | 2026-10-30 |
| CVE-2026-119368 | medium | 5.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configur... | 2026-10-30 |
| CVE-2026-118759 | high | 7.5 | No | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /a... | 2026-10-30 |
| CVE-2026-116638 | high | 7.5 | No | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administ... | 2026-10-30 |
| CVE-2026-116566 | not reported | — | No | socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated. | 2026-10-30 |
| CVE-2026-115805 | high | 7.8 | No | Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated... | 2026-10-30 |
| CVE-2026-115922 | medium | 6.2 | No | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4... | 2026-10-30 |
| CVE-2026-115711 | medium | 6.4 | No | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to cred... | 2026-10-30 |