Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119193 | not reported | — | No | PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.p... | 2026-10-30 |
| CVE-2026-118761 | high | 7.5 | No | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompre... | 2026-10-30 |
| CVE-2026-118758 | high | 7.5 | No | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact han... | 2026-10-30 |
| CVE-2026-96642 | medium | 6.5 | No | Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and comp... | 2026-10-30 |
| CVE-2026-96636 | medium | 6.5 | No | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace... | 2026-10-30 |
| CVE-2026-94266 | high | 7.5 | No | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neit... | 2026-10-30 |
| CVE-2026-94265 | critical | 9.1 | No | When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transm... | 2026-10-30 |
| CVE-2026-92391 | high | 7.5 | No | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations.... | 2026-10-30 |
| CVE-2026-92390 | high | 7.5 | No | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Ear... | 2026-10-30 |
| CVE-2026-93289 | high | 7.5 | No | The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands dur... | 2026-10-30 |
| CVE-2026-86019 | not reported | — | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API u... | 2026-10-30 |
| CVE-2026-87941 | medium | 5.9 | No | Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | 2026-10-30 |
| CVE-2026-86249 | critical | 9.1 | No | On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port ca... | 2026-10-30 |
| CVE-2026-87095 | critical | 9.1 | No | Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber I... | 2026-10-30 |
| CVE-2026-86589 | medium | 5.4 | No | Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A fl... | 2026-10-30 |
| CVE-2026-8374 | not reported | — | No | Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and ac... | 2026-10-30 |
| CVE-2026-79704 | high | 7.5 | No | An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A c... | 2026-10-30 |
| CVE-2026-78334 | critical | 9.1 | No | Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass serve... | 2026-10-30 |
| CVE-2026-78066 | high | 7.5 | No | Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on... | 2026-10-30 |
| CVE-2026-82819 | not reported | — | No | A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By... | 2026-10-30 |