Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78058 | high | 7.5 | No | Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthe... | 2026-10-30 |
| CVE-2026-78048 | high | 7.5 | No | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all pl... | 2026-10-30 |
| CVE-2026-74758 | high | 7.5 | No | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server... | 2026-10-30 |
| CVE-2026-77884 | not reported | — | No | Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on T... | 2026-10-30 |
| CVE-2026-70386 | not reported | — | No | Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlu... | 2026-10-30 |
| CVE-2026-61671 | high | 8.1 | No | WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispat... | 2026-10-30 |
| CVE-2026-57146 | high | 7.5 | No | PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says... | 2026-10-30 |
| CVE-2026-56836 | high | 8.2 | No | PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-fi... | 2026-10-30 |
| CVE-2026-54711 | not reported | — | No | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using... | 2026-10-30 |
| CVE-2026-56832 | high | 8.8 | No | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dang... | 2026-10-30 |
| CVE-2026-55600 | not reported | — | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation inf... | 2026-10-30 |
| CVE-2026-39910 | high | 8.8 | No | STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attac... | 2026-10-30 |
| CVE-2026-119654 | high | 8.8 | No | DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling... | 2026-10-30 |
| CVE-2026-119557 | medium | 5.9 | No | n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach... | 2026-10-30 |
| CVE-2026-119545 | medium | 5.3 | No | Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows u... | 2026-10-30 |
| CVE-2026-119290 | high | 7.5 | No | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes... | 2026-10-30 |
| CVE-2026-119284 | not reported | — | No | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6,... | 2026-10-30 |
| CVE-2026-119283 | high | 7.5 | No | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5,... | 2026-10-30 |
| CVE-2026-118238 | high | 7.2 | No | The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validat... | 2026-10-30 |
| CVE-2026-116622 | high | 7.2 | No | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' para... | 2026-10-30 |