Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119187 | high | 7.5 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa... | 2026-11-04 |
| CVE-2026-119143 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host p... | 2026-11-04 |
| CVE-2026-119139 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports usi... | 2026-11-04 |
| CVE-2026-119135 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type tha... | 2026-11-04 |
| CVE-2026-119131 | medium | 5.3 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests cra... | 2026-11-04 |
| CVE-2026-118947 | medium | 4.3 | No | A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's... | 2026-11-04 |
| CVE-2026-118780 | low | 3.7 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa... | 2026-11-04 |
| CVE-2026-119127 | high | 8.1 | No | ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poiso... | 2026-11-04 |
| CVE-2026-119123 | high | 7.5 | No | ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attack... | 2026-11-04 |
| CVE-2026-119119 | high | 7.5 | No | Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_be... | 2026-11-04 |
| CVE-2026-119054 | medium | 5.4 | No | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users... | 2026-11-04 |
| CVE-2026-117346 | high | 7.5 | No | Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit | 2026-11-04 |
| CVE-2026-118772 | high | 7.5 | No | joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multi... | 2026-11-04 |
| CVE-2026-118766 | medium | 6.1 | No | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP reques... | 2026-11-04 |
| CVE-2026-118762 | critical | 9.3 | No | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_... | 2026-11-04 |
| CVE-2026-110245 | high | 7.5 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication. | 2026-11-04 |
| CVE-2026-110192 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently prot... | 2026-11-04 |
| CVE-2026-104331 | medium | 5.4 | No | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send... | 2026-11-04 |
| CVE-2026-104315 | medium | 4.3 | No | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send... | 2026-11-04 |
| CVE-2026-104308 | medium | 4.3 | No | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralizatio... | 2026-11-04 |