Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-33698 | critical | 9.8 | No | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/... | 2026-10-26 |
| CVE-2026-5483 | critical | 9.9 | No | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOA... | 2026-10-26 |
| CVE-2026-6024 | critical | 9.8 | No | A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the compon... | 2026-10-26 |
| CVE-2026-40154 | critical | 9.6 | No | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code witho... | 2026-10-26 |
| CVE-2026-40114 | critical | 10.0 | No | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body wi... | 2026-10-26 |
| CVE-2026-5974 | critical | 9.8 | No | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt... | 2026-10-26 |
| CVE-2026-5972 | critical | 9.8 | No | A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library... | 2026-10-26 |
| CVE-2026-5971 | critical | 9.8 | No | A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metag... | 2026-10-26 |
| CVE-2026-5970 | critical | 9.8 | No | A vulnerability was detected in FoundationAgents MetaGPT up to 0.8.1. This affects the function check_solution of the component HumanEvalBen... | 2026-10-26 |
| CVE-2026-5962 | critical | 9.8 | No | A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component http... | 2026-10-26 |
| CVE-2026-34184 | critical | 9.1 | No | AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directori... | 2026-10-26 |
| CVE-2026-5849 | critical | 9.8 | No | A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Execu... | 2026-10-26 |
| CVE-2026-39324 | critical | 9.8 | No | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decrypt... | 2026-10-26 |
| CVE-2026-39305 | critical | 10.0 | No | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allo... | 2026-10-26 |
| CVE-2026-23818 | critical | 9.6 | No | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow a... | 2026-10-26 |
| CVE-2026-34444 | critical | 10.0 | No | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attribute... | 2026-10-26 |
| CVE-2026-32871 | critical | 10.0 | No | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to... | 2026-10-26 |
| CVE-2026-5334 | critical | 9.8 | No | A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.p... | 2026-10-26 |
| CVE-2026-5333 | critical | 9.8 | No | A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file... | 2026-10-26 |
| CVE-2026-29143 | critical | 9.1 | No | SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allo... | 2026-10-26 |