Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-74881 | critical | 9.3 | No | openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can... | 2026-10-08 |
| CVE-2026-35002 | critical | 9.8 | No | Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to ex... | 2026-10-08 |
| CVE-2026-32064 | critical | 9.1 | No | OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing... | 2026-10-08 |
| CVE-2026-24425 | critical | 9.9 | No | Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attacker... | 2026-10-08 |
| CVE-2026-106326 | medium | 4.4 | No | Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions in... | 2026-10-08 |
| CVE-2026-106324 | medium | 6.1 | No | Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system a... | 2026-10-08 |
| CVE-2026-106198 | high | 8.2 | No | Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce... | 2026-10-08 |
| CVE-2026-106188 | high | 7.1 | No | Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictio... | 2026-10-08 |
| CVE-2026-104473 | medium | 6.1 | No | YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript throu... | 2026-10-08 |
| CVE-2026-101056 | medium | 5.3 | No | Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previ... | 2026-10-08 |
| CVE-2026-101048 | medium | 5.4 | No | Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/down... | 2026-10-08 |
| CVE-2026-100868 | medium | 6.3 | No | Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unau... | 2026-10-08 |
| CVE-2026-100857 | high | 8.0 | No | AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoa... | 2026-10-08 |
| CVE-2026-100856 | high | 8.8 | No | AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vuln... | 2026-10-08 |
| CVE-2026-100855 | medium | 6.5 | No | AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that... | 2026-10-08 |
| CVE-2026-100854 | medium | 6.3 | No | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag fr... | 2026-10-08 |
| CVE-2026-100846 | high | 8.8 | No | MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py.... | 2026-10-08 |
| CVE-2026-100839 | high | 8.4 | No | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable t... | 2026-10-08 |
| CVE-2026-100838 | high | 8.1 | No | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CL... | 2026-10-08 |
| CVE-2026-100688 | medium | 6.5 | No | Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage en... | 2026-10-08 |