Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-6942 | high | 8.8 | No | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary comma... | 2026-10-29 |
| CVE-2026-6257 | critical | 9.1 | No | Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return stateme... | 2026-10-29 |
| CVE-2026-67214 | high | 7.5 | No | nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nan... | 2026-10-29 |
| CVE-2026-65902 | medium | 6.1 | No | DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeEl... | 2026-10-29 |
| CVE-2026-65689 | critical | 9.8 | No | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature... | 2026-10-29 |
| CVE-2026-65014 | medium | 5.3 | No | n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentica... | 2026-10-29 |
| CVE-2026-63308 | medium | 6.5 | No | Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/fil... | 2026-10-29 |
| CVE-2026-61872 | low | 2.5 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supply... | 2026-10-29 |
| CVE-2026-61871 | low | 3.7 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing... | 2026-10-29 |
| CVE-2026-61869 | low | 2.9 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF... | 2026-10-29 |
| CVE-2026-61868 | low | 3.7 | No | ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails.... | 2026-10-29 |
| CVE-2026-61865 | low | 2.9 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memo... | 2026-10-29 |
| CVE-2026-61864 | low | 2.9 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a... | 2026-10-29 |
| CVE-2026-61863 | high | 7.5 | No | ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot b... | 2026-10-29 |
| CVE-2026-61862 | low | 2.9 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify co... | 2026-10-29 |
| CVE-2026-61870 | high | 7.5 | No | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger all... | 2026-10-29 |
| CVE-2026-61861 | high | 7.5 | No | ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attacker... | 2026-10-29 |
| CVE-2026-61529 | medium | 4.7 | No | Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submis... | 2026-10-29 |
| CVE-2026-61860 | low | 3.7 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method... | 2026-10-29 |
| CVE-2026-61859 | low | 3.3 | No | ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing sec... | 2026-10-29 |