Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117866 | high | 7.3 | No | Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115... | 2026-11-04 |
| CVE-2026-117557 | medium | 6.1 | No | SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips... | 2026-11-04 |
| CVE-2026-117538 | medium | 4.1 | No | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is co... | 2026-11-04 |
| CVE-2026-117534 | medium | 5.4 | No | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete his... | 2026-11-04 |
| CVE-2026-117530 | medium | 6.7 | No | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands | 2026-11-04 |
| CVE-2026-117499 | low | 3.7 | No | @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that r... | 2026-11-04 |
| CVE-2026-116899 | medium | 6.5 | No | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categ... | 2026-11-04 |
| CVE-2026-116895 | medium | 5.4 | No | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.p... | 2026-11-04 |
| CVE-2026-116887 | medium | 5.4 | No | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to i... | 2026-11-04 |
| CVE-2026-116883 | medium | 4.8 | No | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to... | 2026-11-04 |
| CVE-2026-117494 | not reported | — | No | Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64.... | 2026-11-04 |
| CVE-2026-117493 | not reported | — | No | Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘... | 2026-11-04 |
| CVE-2026-113957 | medium | 5.6 | No | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pul... | 2026-11-04 |
| CVE-2026-115624 | medium | 5.3 | No | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi... | 2026-11-04 |
| CVE-2026-115408 | medium | 5.5 | No | In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, | 2026-11-04 |
| CVE-2026-116875 | medium | 6.1 | No | SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator pa... | 2026-11-04 |
| CVE-2026-116871 | high | 7.5 | No | Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that proces... | 2026-11-04 |
| CVE-2026-116870 | not reported | — | No | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from... | 2026-11-04 |
| CVE-2026-116188 | medium | 5.3 | No | rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses... | 2026-11-04 |
| CVE-2026-112605 | low | 3.3 | No | This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files. | 2026-11-04 |