Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120631 | not reported | — | No | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. C... | 2026-11-04 |
| CVE-2026-116246 | high | 7.6 | No | To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's... | 2026-11-04 |
| CVE-2026-116247 | critical | 9.6 | No | When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAd... | 2026-11-04 |
| CVE-2026-9212 | high | 8.0 | No | Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands... | 2026-11-04 |
| CVE-2026-87086 | high | 7.5 | No | Tanium addressed a denial of service vulnerability in Provision. | 2026-11-04 |
| CVE-2026-87897 | medium | 4.6 | No | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for anot... | 2026-11-04 |
| CVE-2026-58115 | critical | 10.0 | No | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions | 2026-11-04 |
| CVE-2026-58949 | high | 7.5 | No | In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead... | 2026-11-04 |
| CVE-2026-58814 | high | 7.5 | No | In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of... | 2026-11-04 |
| CVE-2026-82986 | medium | 4.6 | No | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though t... | 2026-11-04 |
| CVE-2026-82983 | low | 3.3 | No | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe... | 2026-11-04 |
| CVE-2026-77172 | medium | 5.3 | No | App passwords were allowed to bypass password confirmation on sensitive endpoints. | 2026-11-04 |
| CVE-2026-55292 | medium | 5.3 | No | In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information dis... | 2026-11-04 |
| CVE-2026-49912 | medium | 4.0 | No | In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in... | 2026-11-04 |
| CVE-2026-28632 | medium | 4.0 | No | In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local inf... | 2026-11-04 |
| CVE-2026-121927 | medium | 6.3 | No | A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/da... | 2026-11-04 |
| CVE-2026-16491 | medium | 6.5 | No | Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings.... | 2026-11-04 |
| CVE-2026-12887 | not reported | — | No | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the sc... | 2026-11-04 |
| CVE-2026-118131 | critical | 9.8 | No | GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\Pro... | 2026-11-04 |
| CVE-2026-117879 | high | 7.3 | No | Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR... | 2026-11-04 |