Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-55486 | critical | 9.3 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version... | 2026-10-30 |
| CVE-2026-55457 | high | 7.4 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration... | 2026-10-30 |
| CVE-2026-46652 | critical | 9.8 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version... | 2026-10-30 |
| CVE-2026-57117 | high | 8.8 | No | PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging w... | 2026-10-30 |
| CVE-2026-54238 | low | 3.1 | No | Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints... | 2026-10-30 |
| CVE-2026-119706 | critical | 9.8 | No | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run O... | 2026-10-30 |
| CVE-2026-119665 | medium | 6.3 | No | WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows au... | 2026-10-30 |
| CVE-2026-119657 | medium | 5.0 | No | FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage othe... | 2026-10-30 |
| CVE-2026-119602 | low | 3.7 | No | libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to le... | 2026-10-30 |
| CVE-2026-119577 | medium | 6.8 | No | ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Pos... | 2026-10-30 |
| CVE-2026-119570 | low | 3.1 | No | Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected fiel... | 2026-10-30 |
| CVE-2026-119569 | medium | 5.3 | No | Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are ex... | 2026-10-30 |
| CVE-2026-119542 | medium | 4.3 | No | A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust... | 2026-10-30 |
| CVE-2026-119370 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Cale... | 2026-10-30 |
| CVE-2026-118500 | medium | 6.4 | No | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via... | 2026-10-30 |
| CVE-2026-116860 | medium | 5.3 | No | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-30 |
| CVE-2026-116773 | medium | 4.3 | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::proce... | 2026-10-30 |
| CVE-2026-116685 | medium | 5.9 | No | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and... | 2026-10-30 |
| CVE-2026-116590 | medium | 5.9 | No | snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object... | 2026-10-30 |
| CVE-2026-116582 | medium | 4.7 | No | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and fr... | 2026-10-30 |