Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90441 | high | 8.1 | No | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil... | 2026-10-06 |
| CVE-2026-103099 | high | 7.5 | No | Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a s... | 2026-10-06 |
| CVE-2026-67421 | medium | 6.8 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an... | 2026-10-06 |
| CVE-2026-100647 | high | 7.5 | No | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropi... | 2026-10-06 |
| CVE-2026-100648 | medium | 5.3 | No | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated client... | 2026-10-06 |
| CVE-2026-100649 | medium | 5.3 | No | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allo... | 2026-10-06 |
| CVE-2026-100650 | medium | 6.5 | No | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO... | 2026-10-06 |
| CVE-2026-100651 | medium | 6.5 | No | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the... | 2026-10-06 |
| CVE-2026-100652 | high | 7.5 | No | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-... | 2026-10-06 |
| CVE-2026-9032 | not reported | — | No | Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable witho... | 2026-10-06 |
| CVE-2026-105764 | not reported | — | No | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload S... | 2026-10-06 |
| CVE-2026-105740 | critical | 9.9 | No | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve R... | 2026-10-06 |
| CVE-2026-103957 | medium | 6.2 | No | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain... | 2026-10-06 |
| CVE-2026-104914 | not reported | — | No | MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries... | 2026-10-06 |
| CVE-2026-103446 | not reported | — | No | Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authenticat... | 2026-10-06 |
| CVE-2026-103623 | high | 8.8 | No | Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox... | 2026-10-06 |
| CVE-2026-103627 | medium | 6.5 | No | Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML... | 2026-10-06 |
| CVE-2026-103631 | high | 8.8 | No | Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via... | 2026-10-06 |
| CVE-2026-102269 | medium | 5.4 | No | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment... | 2026-10-06 |
| CVE-2026-102270 | medium | 4.9 | No | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expr... | 2026-10-06 |