Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101412 | medium | 5.8 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that ar... | 2026-10-30 |
| CVE-2026-101780 | medium | 6.5 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected... | 2026-10-30 |
| CVE-2026-101779 | low | 2.7 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affecte... | 2026-10-30 |
| CVE-2026-86147 | high | 7.5 | No | External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote... | 2026-10-30 |
| CVE-2026-86146 | high | 7.5 | No | Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18... | 2026-10-30 |
| CVE-2026-84748 | high | 7.5 | No | Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the pu... | 2026-10-30 |
| CVE-2026-84747 | high | 7.5 | No | Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to by... | 2026-10-30 |
| CVE-2026-82942 | high | 7.5 | No | A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service)... | 2026-10-30 |
| CVE-2026-82425 | high | 7.5 | No | A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in d... | 2026-10-30 |
| CVE-2026-82231 | high | 7.5 | No | A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks... | 2026-10-30 |
| CVE-2026-82210 | high | 7.5 | No | Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the serv... | 2026-10-30 |
| CVE-2026-81755 | high | 7.5 | No | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust serve... | 2026-10-30 |
| CVE-2026-80463 | high | 7.5 | No | Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attacke... | 2026-10-30 |
| CVE-2026-61916 | high | 7.5 | No | Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is... | 2026-10-30 |
| CVE-2026-55888 | not reported | — | No | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFi... | 2026-10-30 |
| CVE-2026-118256 | not reported | — | No | Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called... | 2026-10-30 |
| CVE-2026-116678 | medium | 5.8 | No | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial... | 2026-10-30 |
| CVE-2026-116578 | not reported | — | No | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place reg... | 2026-10-30 |
| CVE-2026-115918 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authentica... | 2026-10-30 |
| CVE-2026-115914 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited... | 2026-10-30 |