Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115709 | high | 8.2 | No | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosur... | 2026-10-30 |
| CVE-2026-115708 | high | 7.2 | No | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass... | 2026-10-30 |
| CVE-2026-115707 | medium | 6.4 | No | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to priv... | 2026-10-30 |
| CVE-2026-115706 | medium | 6.8 | No | Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege... | 2026-10-30 |
| CVE-2026-115478 | not reported | — | No | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_en... | 2026-10-30 |
| CVE-2026-114131 | medium | 6.5 | No | Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw... | 2026-10-30 |
| CVE-2026-112921 | high | 7.3 | No | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over fro... | 2026-10-30 |
| CVE-2026-113787 | medium | 6.1 | No | odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in v... | 2026-10-30 |
| CVE-2026-112712 | critical | 9.1 | No | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-s... | 2026-10-30 |
| CVE-2026-110803 | not reported | — | No | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releas... | 2026-10-30 |
| CVE-2026-110322 | medium | 5.5 | No | The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields duri... | 2026-10-30 |
| CVE-2026-110196 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-... | 2026-10-30 |
| CVE-2026-110186 | critical | 9.8 | No | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | 2026-10-30 |
| CVE-2026-107329 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code... | 2026-10-30 |
| CVE-2026-107327 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. | 2026-10-30 |
| CVE-2026-107326 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization o... | 2026-10-30 |
| CVE-2026-107080 | medium | 6.5 | No | OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinter... | 2026-10-30 |
| CVE-2026-107588 | not reported | — | No | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25,... | 2026-10-30 |
| CVE-2026-106972 | high | 7.5 | No | Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denia... | 2026-10-30 |
| CVE-2026-107067 | medium | 6.2 | No | An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information | 2026-10-30 |