Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116245 | critical | 9.6 | No | libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a pas... | 2026-11-04 |
| CVE-2026-120651 | not reported | — | No | CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD or... | 2026-11-04 |
| CVE-2026-120650 | not reported | — | No | CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.... | 2026-11-04 |
| CVE-2026-120648 | not reported | — | No | CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between without escaping, s... | 2026-11-04 |
| CVE-2026-120647 | not reported | — | No | CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenam... | 2026-11-04 |
| CVE-2026-120646 | not reported | — | No | CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.... | 2026-11-04 |
| CVE-2026-120645 | not reported | — | No | CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. Wh... | 2026-11-04 |
| CVE-2026-120644 | not reported | — | No | CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domai... | 2026-11-04 |
| CVE-2026-120643 | not reported | — | No | CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both pass... | 2026-11-04 |
| CVE-2026-120642 | not reported | — | No | CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pa... | 2026-11-04 |
| CVE-2026-120641 | not reported | — | No | CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned... | 2026-11-04 |
| CVE-2026-120640 | not reported | — | No | CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form... | 2026-11-04 |
| CVE-2026-120639 | not reported | — | No | CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in... | 2026-11-04 |
| CVE-2026-120638 | not reported | — | No | CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redire... | 2026-11-04 |
| CVE-2026-120637 | not reported | — | No | CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a... | 2026-11-04 |
| CVE-2026-120636 | not reported | — | No | CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-abs... | 2026-11-04 |
| CVE-2026-120635 | not reported | — | No | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.... | 2026-11-04 |
| CVE-2026-120634 | not reported | — | No | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings... | 2026-11-04 |
| CVE-2026-120633 | not reported | — | No | CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the... | 2026-11-04 |
| CVE-2026-120632 | not reported | — | No | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST C... | 2026-11-04 |