Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96780 | not reported | — | No | figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can... | 2026-10-02 |
| CVE-2026-104183 | medium | 5.1 | No | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler... | 2026-10-02 |
| CVE-2026-102370 | not reported | — | No | Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloade... | 2026-10-02 |
| CVE-2026-93832 | medium | 4.4 | No | A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions f... | 2026-10-02 |
| CVE-2026-53964 | high | 7.2 | No | Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to ve... | 2026-10-02 |
| CVE-2026-104059 | high | 8.1 | No | Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attack... | 2026-10-02 |
| CVE-2026-104058 | medium | 5.3 | No | Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the... | 2026-10-02 |
| CVE-2026-104057 | high | 7.5 | No | Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers... | 2026-10-02 |
| CVE-2026-21833 | low | 3.7 | No | HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent... | 2026-10-02 |
| CVE-2026-94620 | not reported | — | No | Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teache... | 2026-10-02 |
| CVE-2026-75101 | medium | 6.5 | No | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read... | 2026-10-02 |
| CVE-2026-103921 | high | 7.4 | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacy... | 2026-10-02 |
| CVE-2026-104847 | not reported | — | No | ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view... | 2026-10-02 |
| CVE-2026-104844 | medium | 5.9 | No | PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWo... | 2026-10-02 |
| CVE-2026-104843 | not reported | — | No | uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a maliciou... | 2026-10-02 |
| CVE-2026-90970 | critical | 9.9 | No | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4,... | 2026-10-02 |
| CVE-2026-104026 | high | 7.8 | No | In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed... | 2026-10-02 |
| CVE-2026-97876 | medium | 6.4 | No | A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned... | 2026-10-02 |
| CVE-2026-68496 | high | 7.5 | No | The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object... | 2026-10-02 |
| CVE-2026-68495 | high | 7.5 | No | The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object p... | 2026-10-02 |