Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-122054 | medium | 5.9 | No | Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.... | 2026-11-04 |
| CVE-2026-122032 | medium | 6.5 | No | SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQ... | 2026-11-04 |
| CVE-2026-122007 | medium | 6.5 | No | Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site admi... | 2026-11-04 |
| CVE-2026-121967 | medium | 4.9 | No | Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.3... | 2026-11-04 |
| CVE-2026-121966 | high | 8.7 | No | Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an aut... | 2026-11-04 |
| CVE-2026-121965 | medium | 5.3 | No | Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Cod... | 2026-11-04 |
| CVE-2026-121964 | high | 7.5 | No | FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and... | 2026-11-04 |
| CVE-2026-121993 | medium | 4.3 | No | wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route... | 2026-11-04 |
| CVE-2026-121970 | low | 3.7 | No | Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerabilit... | 2026-11-04 |
| CVE-2026-121946 | high | 7.2 | No | zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that... | 2026-11-04 |
| CVE-2026-121945 | high | 7.6 | No | CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incide... | 2026-11-04 |
| CVE-2026-121944 | medium | 5.5 | No | sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause de... | 2026-11-04 |
| CVE-2026-121943 | medium | 4.8 | No | Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off... | 2026-11-04 |
| CVE-2026-121942 | medium | 6.1 | No | ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap m... | 2026-11-04 |
| CVE-2026-121940 | high | 8.8 | No | Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access o... | 2026-11-04 |
| CVE-2026-121939 | high | 8.1 | No | Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identiti... | 2026-11-04 |
| CVE-2026-121938 | medium | 5.3 | No | langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other... | 2026-11-04 |
| CVE-2026-121932 | critical | 10.0 | No | A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manip... | 2026-11-04 |
| CVE-2026-121931 | critical | 9.1 | No | A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of... | 2026-11-04 |
| CVE-2026-121930 | critical | 9.1 | No | A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the componen... | 2026-11-04 |