Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84911 | low | 3.1 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) al... | 2026-10-22 |
| CVE-2026-84910 | medium | 4.2 | No | Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.... | 2026-10-22 |
| CVE-2026-114112 | not reported | — | No | Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based L... | 2026-10-22 |
| CVE-2026-113725 | high | 7.8 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment n... | 2026-10-22 |
| CVE-2026-113720 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to cop... | 2026-10-22 |
| CVE-2026-113719 | medium | 4.5 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts e... | 2026-10-22 |
| CVE-2026-113717 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder p... | 2026-10-22 |
| CVE-2026-113716 | medium | 4.5 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executa... | 2026-10-22 |
| CVE-2026-98123 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sct... | 2026-10-22 |
| CVE-2026-98124 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3_zer... | 2026-10-22 |
| CVE-2026-98125 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3_insert_... | 2026-10-22 |
| CVE-2026-87955 | medium | 4.3 | No | Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field version... | 2026-10-22 |
| CVE-2026-92812 | critical | 9.8 | No | Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix compariso... | 2026-10-22 |
| CVE-2026-114479 | medium | 5.8 | No | Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unau... | 2026-10-22 |
| CVE-2026-23706 | medium | 6.5 | No | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For... | 2026-10-22 |
| CVE-2026-114102 | high | 7.5 | No | adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a mal... | 2026-10-22 |
| CVE-2026-114097 | high | 7.8 | No | Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to writ... | 2026-10-22 |
| CVE-2026-114092 | medium | 6.5 | No | Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources... | 2026-10-22 |
| CVE-2026-114087 | high | 8.1 | No | Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authenticat... | 2026-10-22 |
| CVE-2026-101829 | high | 7.4 | No | Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported version... | 2026-10-22 |