Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116013 | low | 3.7 | No | OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to... | 2026-10-29 |
| CVE-2026-116004 | low | 3.5 | No | A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/c... | 2026-10-29 |
| CVE-2026-115997 | medium | 6.3 | No | A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/... | 2026-10-29 |
| CVE-2026-115982 | medium | 4.3 | No | A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/sho... | 2026-10-29 |
| CVE-2026-115972 | medium | 5.3 | No | A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.cha... | 2026-10-29 |
| CVE-2026-115969 | high | 7.3 | No | A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API.... | 2026-10-29 |
| CVE-2026-116009 | high | 8.8 | No | Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files... | 2026-10-29 |
| CVE-2026-115893 | critical | 9.9 | No | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br... | 2026-10-29 |
| CVE-2026-115886 | medium | 6.5 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0... | 2026-10-29 |
| CVE-2026-115801 | medium | 5.3 | No | A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src... | 2026-10-29 |
| CVE-2026-115775 | not reported | — | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish Ex... | 2026-10-29 |
| CVE-2026-115796 | medium | 4.3 | No | A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Per... | 2026-10-29 |
| CVE-2026-113867 | critical | 9.1 | No | Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back i... | 2026-10-29 |
| CVE-2026-112380 | critical | 9.9 | No | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsA... | 2026-10-29 |
| CVE-2026-111088 | medium | 6.5 | No | A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen. | 2026-10-29 |
| CVE-2026-105923 | not reported | — | No | A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. | 2026-10-29 |
| CVE-2026-109125 | medium | 5.3 | No | In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-thresho... | 2026-10-29 |
| CVE-2026-109576 | medium | 5.5 | No | The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed... | 2026-10-29 |
| CVE-2026-108087 | high | 8.8 | No | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache... | 2026-10-29 |
| CVE-2026-108086 | high | 7.5 | No | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache... | 2026-10-29 |