Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113608 | medium | 5.3 | No | Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql:... | 2026-10-21 |
| CVE-2026-113603 | medium | 6.5 | No | The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.... | 2026-10-21 |
| CVE-2026-113598 | medium | 4.3 | No | Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other do... | 2026-10-21 |
| CVE-2026-113359 | medium | 4.3 | No | Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other works... | 2026-10-21 |
| CVE-2026-112957 | medium | 4.3 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRo... | 2026-10-21 |
| CVE-2026-112952 | medium | 4.3 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body {... | 2026-10-21 |
| CVE-2026-112947 | not reported | — | No | Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setti... | 2026-10-21 |
| CVE-2026-112942 | not reported | — | No | launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an at... | 2026-10-21 |
| CVE-2026-102536 | not reported | — | No | Rejected reason: This CVE has been rejected because it was issued to a development-only issue with no affected distributed version identifie... | 2026-10-21 |
| CVE-2026-111763 | not reported | — | No | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can... | 2026-10-21 |
| CVE-2026-100134 | high | 8.8 | No | Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cur... | 2026-10-21 |
| CVE-2026-106576 | high | 7.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can... | 2026-10-21 |
| CVE-2026-106577 | medium | 6.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or... | 2026-10-21 |
| CVE-2026-106578 | high | 7.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted im... | 2026-10-21 |
| CVE-2026-106579 | high | 7.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted im... | 2026-10-21 |
| CVE-2026-106580 | high | 8.2 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing se... | 2026-10-21 |
| CVE-2026-83853 | high | 7.0 | No | Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-107208 | medium | 5.3 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XM... | 2026-10-21 |
| CVE-2026-83854 | medium | 5.5 | No | Improper access control in Windows Notification allows an authorized attacker to disclose information locally. | 2026-10-21 |
| CVE-2026-83855 | high | 7.5 | No | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network. | 2026-10-21 |