Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121746 | medium | 5.5 | No | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `n... | 2026-11-04 |
| CVE-2026-121745 | low | 2.5 | No | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, wh... | 2026-11-04 |
| CVE-2026-120830 | high | 7.4 | No | A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet wa... | 2026-11-04 |
| CVE-2026-120194 | high | 7.5 | No | A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expressi... | 2026-11-04 |
| CVE-2026-11837 | high | 7.3 | No | A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.cho... | 2026-11-04 |
| CVE-2026-11610 | high | 8.8 | No | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integri... | 2026-11-04 |
| CVE-2026-11807 | critical | 9.6 | No | A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint d... | 2026-11-04 |
| CVE-2026-11774 | high | 7.6 | No | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uin... | 2026-11-04 |
| CVE-2026-11332 | high | 7.8 | No | A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirement... | 2026-11-04 |
| CVE-2026-115473 | medium | 6.5 | No | Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requirin... | 2026-11-04 |
| CVE-2026-116858 | medium | 4.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code In... | 2026-11-04 |
| CVE-2026-119777 | high | 8.8 | No | A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflo... | 2026-11-04 |
| CVE-2026-119528 | high | 7.8 | No | A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resourc... | 2026-11-04 |
| CVE-2026-114187 | medium | 5.3 | No | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control... | 2026-11-04 |
| CVE-2026-111079 | high | 7.4 | No | A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it ver... | 2026-11-04 |
| CVE-2026-112177 | high | 7.3 | No | A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase... | 2026-11-04 |
| CVE-2026-112261 | high | 7.8 | No | A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main... | 2026-11-04 |
| CVE-2026-112258 | high | 7.8 | No | A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed v... | 2026-11-04 |
| CVE-2026-112257 | high | 7.8 | No | A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verif... | 2026-11-04 |
| CVE-2026-112260 | high | 7.1 | No | A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacen... | 2026-11-04 |