Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-70275 | critical | 9.8 | No | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-117505 | medium | 4.3 | No | A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the compon... | 2026-10-28 |
| CVE-2026-116774 | medium | 4.3 | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open par... | 2026-10-28 |
| CVE-2026-116694 | not reported | — | No | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propaga... | 2026-10-28 |
| CVE-2026-116690 | high | 7.5 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, t... | 2026-10-28 |
| CVE-2026-116686 | medium | 6.5 | No | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 an... | 2026-10-28 |
| CVE-2026-116679 | medium | 5.4 | No | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mo... | 2026-10-28 |
| CVE-2026-116675 | not reported | — | No | TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted thr... | 2026-10-28 |
| CVE-2026-116673 | low | 3.3 | No | systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses th... | 2026-10-28 |
| CVE-2026-114403 | high | 8.1 | No | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PH... | 2026-10-28 |
| CVE-2026-114388 | medium | 5.3 | No | Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController th... | 2026-10-28 |
| CVE-2026-114256 | high | 7.3 | No | A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the funct... | 2026-10-28 |
| CVE-2026-114253 | medium | 6.3 | No | A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element... | 2026-10-28 |
| CVE-2026-114250 | medium | 6.3 | No | A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unk... | 2026-10-28 |
| CVE-2026-114243 | high | 7.3 | No | A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d740... | 2026-10-28 |
| CVE-2026-114119 | critical | 9.8 | No | Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all... | 2026-10-28 |
| CVE-2026-114114 | medium | 5.3 | No | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset valu... | 2026-10-28 |
| CVE-2026-114109 | high | 8.8 | No | uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via craf... | 2026-10-28 |
| CVE-2026-114104 | medium | 5.9 | No | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying... | 2026-10-28 |
| CVE-2026-114099 | medium | 5.8 | No | Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping... | 2026-10-28 |