Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62374 | not reported | — | No | SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/dec... | 2026-11-04 |
| CVE-2026-93009 | medium | 4.3 | No | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the... | 2026-11-04 |
| CVE-2026-121610 | high | 7.3 | No | A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the com... | 2026-11-04 |
| CVE-2026-121609 | critical | 10.0 | No | A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/m... | 2026-11-04 |
| CVE-2026-121608 | high | 7.3 | No | A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message o... | 2026-11-04 |
| CVE-2026-61673 | not reported | — | No | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/l... | 2026-11-04 |
| CVE-2026-45049 | high | 8.3 | No | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allow... | 2026-11-04 |
| CVE-2026-121607 | critical | 10.0 | No | A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file... | 2026-11-04 |
| CVE-2026-119407 | high | 7.1 | No | Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthe... | 2026-11-04 |
| CVE-2026-119376 | medium | 5.5 | No | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining... | 2026-11-04 |
| CVE-2026-119372 | medium | 5.5 | No | SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() ca... | 2026-11-04 |
| CVE-2026-119285 | medium | 5.9 | No | Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in... | 2026-11-04 |
| CVE-2026-119281 | medium | 5.9 | No | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5... | 2026-11-04 |
| CVE-2026-119277 | medium | 5.9 | No | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5... | 2026-11-04 |
| CVE-2026-119208 | medium | 5.5 | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application ac... | 2026-11-04 |
| CVE-2026-119204 | medium | 5.5 | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF pag... | 2026-11-04 |
| CVE-2026-119200 | medium | 6.5 | No | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments b... | 2026-11-04 |
| CVE-2026-119196 | high | 7.5 | No | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit... | 2026-11-04 |
| CVE-2026-119191 | high | 7.5 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa... | 2026-11-04 |
| CVE-2026-119146 | medium | 5.6 | No | ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote... | 2026-11-04 |