Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119126 | low | 3.1 | No | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the sav... | 2026-10-29 |
| CVE-2026-119122 | medium | 5.3 | No | Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the... | 2026-10-29 |
| CVE-2026-119118 | medium | 6.5 | No | Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Ch... | 2026-10-29 |
| CVE-2026-118651 | medium | 5.3 | No | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it t... | 2026-10-29 |
| CVE-2026-118687 | medium | 6.5 | No | Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audi... | 2026-10-29 |
| CVE-2026-118683 | high | 8.8 | No | MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/log... | 2026-10-29 |
| CVE-2026-118678 | high | 7.1 | No | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in o... | 2026-10-29 |
| CVE-2026-118649 | high | 8.3 | No | n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that... | 2026-10-29 |
| CVE-2026-118645 | high | 8.7 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sen... | 2026-10-29 |
| CVE-2026-118641 | high | 7.5 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook... | 2026-10-29 |
| CVE-2026-118257 | high | 7.2 | No | Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTra... | 2026-10-29 |
| CVE-2026-118253 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen langu... | 2026-10-29 |
| CVE-2026-118249 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point... | 2026-10-29 |
| CVE-2026-118245 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unche... | 2026-10-29 |
| CVE-2026-116124 | medium | 6.3 | No | A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the... | 2026-10-29 |
| CVE-2026-116121 | low | 3.7 | No | A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the com... | 2026-10-29 |
| CVE-2026-116118 | medium | 6.3 | No | A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed... | 2026-10-29 |
| CVE-2026-116115 | low | 3.1 | No | A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicant... | 2026-10-29 |
| CVE-2026-116211 | high | 8.2 | No | YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-c... | 2026-10-29 |
| CVE-2026-116205 | medium | 5.3 | No | YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary U... | 2026-10-29 |