Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115911 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat... | 2026-10-30 |
| CVE-2026-115907 | high | 7.5 | No | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy... | 2026-10-30 |
| CVE-2026-115776 | high | 7.5 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.... | 2026-10-30 |
| CVE-2026-114144 | high | 7.5 | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decima... | 2026-10-30 |
| CVE-2026-114140 | not reported | — | No | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, Ext... | 2026-10-30 |
| CVE-2026-104949 | medium | 5.4 | No | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_c... | 2026-10-30 |
| CVE-2026-101778 | medium | 6.5 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that a... | 2026-10-30 |
| CVE-2026-114716 | high | 8.5 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline... | 2026-10-30 |
| CVE-2026-101777 | medium | 5.5 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that... | 2026-10-30 |
| CVE-2026-101776 | medium | 4.9 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions t... | 2026-10-30 |
| CVE-2026-101775 | high | 7.4 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affec... | 2026-10-30 |
| CVE-2026-115712 | medium | 4.3 | No | Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Acc... | 2026-10-30 |
| CVE-2026-114717 | medium | 5.8 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as a... | 2026-10-30 |
| CVE-2026-115713 | high | 7.5 | No | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and... | 2026-10-30 |
| CVE-2026-101774 | medium | 6.5 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are af... | 2026-10-30 |
| CVE-2026-114718 | medium | 6.1 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error tex... | 2026-10-30 |
| CVE-2026-114720 | high | 7.1 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attack... | 2026-10-30 |
| CVE-2026-63873 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() a... | 2026-10-30 |
| CVE-2026-63875 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_u... | 2026-10-30 |
| CVE-2026-63874 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellati... | 2026-10-30 |