Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56363 | low | 3.3 | No | ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of... | 2026-10-29 |
| CVE-2026-56361 | high | 7.1 | No | ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can tr... | 2026-10-29 |
| CVE-2026-54390 | critical | 9.8 | No | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to injec... | 2026-10-29 |
| CVE-2026-55202 | high | 8.2 | No | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenti... | 2026-10-29 |
| CVE-2026-43629 | high | 8.1 | No | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_da... | 2026-10-29 |
| CVE-2026-43628 | high | 7.8 | No | llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauth... | 2026-10-29 |
| CVE-2026-43627 | high | 7.8 | No | llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplica... | 2026-10-29 |
| CVE-2026-43622 | high | 7.8 | No | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memor... | 2026-10-29 |
| CVE-2026-53987 | medium | 6.4 | No | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via Plugi... | 2026-10-29 |
| CVE-2026-47119 | medium | 6.1 | No | Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in... | 2026-10-29 |
| CVE-2026-41401 | medium | 6.5 | No | libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list... | 2026-10-29 |
| CVE-2026-13717 | high | 8.8 | No | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a... | 2026-10-29 |
| CVE-2026-35632 | high | 7.8 | No | OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on I... | 2026-10-29 |
| CVE-2026-40037 | medium | 6.5 | No | OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent a... | 2026-10-29 |
| CVE-2026-22185 | not reported | — | No | OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in... | 2026-10-29 |
| CVE-2026-31158 | critical | 9.8 | No | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Lo... | 2026-10-29 |
| CVE-2026-119142 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by Type... | 2026-10-29 |
| CVE-2026-119138 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an as... | 2026-10-29 |
| CVE-2026-119134 | medium | 6.2 | No | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component insta... | 2026-10-29 |
| CVE-2026-119130 | low | 2.6 | No | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-htt... | 2026-10-29 |