Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106781 | high | 7.8 | No | An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileg... | 2026-10-30 |
| CVE-2026-105960 | medium | 5.5 | No | PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued reco... | 2026-10-30 |
| CVE-2026-104324 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrus... | 2026-10-30 |
| CVE-2026-104317 | critical | 9.8 | No | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the syst... | 2026-10-30 |
| CVE-2026-104594 | high | 7.5 | No | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker... | 2026-10-30 |
| CVE-2026-101288 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization o... | 2026-10-30 |
| CVE-2026-103090 | not reported | — | No | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment st... | 2026-10-30 |
| CVE-2026-100420 | not reported | — | No | A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plai... | 2026-10-30 |
| CVE-2025-8444 | medium | 6.4 | No | The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Store... | 2026-10-30 |
| CVE-2025-0326 | high | 7.4 | No | The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations... | 2026-10-30 |
| CVE-2024-7478 | medium | 5.8 | No | When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernam... | 2026-10-30 |
| CVE-2026-67240 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^.... | 2026-10-30 |
| CVE-2026-67228 | medium | 4.9 | No | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :compone... | 2026-10-30 |
| CVE-2026-66069 | medium | 4.3 | No | RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all... | 2026-10-30 |
| CVE-2026-66067 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it o... | 2026-10-30 |
| CVE-2026-67238 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-su... | 2026-10-30 |
| CVE-2026-65959 | medium | 5.3 | No | Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHt... | 2026-10-30 |
| CVE-2026-63912 | critical | 9.8 | No | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-pla... | 2026-10-30 |
| CVE-2026-63913 | high | 8.2 | No | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST withou... | 2026-10-30 |
| CVE-2026-118165 | medium | 6.8 | No | The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it... | 2026-10-30 |