Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116891 | medium | 6.1 | No | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i... | 2026-11-04 |
| CVE-2026-116879 | medium | 5.4 | No | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with... | 2026-11-04 |
| CVE-2026-116739 | medium | 4.3 | No | VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memor... | 2026-11-04 |
| CVE-2026-116489 | high | 7.5 | No | Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by... | 2026-11-04 |
| CVE-2026-116200 | medium | 5.9 | No | Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP... | 2026-11-04 |
| CVE-2026-116176 | high | 8.2 | No | vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by... | 2026-11-04 |
| CVE-2026-115448 | not reported | — | No | Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level,... | 2026-11-04 |
| CVE-2026-116172 | high | 7.5 | No | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers t... | 2026-11-04 |
| CVE-2026-116168 | medium | 6.2 | No | SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete s... | 2026-11-04 |
| CVE-2026-115724 | low | 2.9 | No | VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based on... | 2026-11-04 |
| CVE-2026-115507 | low | 3.5 | No | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpol... | 2026-11-04 |
| CVE-2026-115391 | medium | 5.8 | No | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementati... | 2026-11-04 |
| CVE-2026-114656 | critical | 9.3 | No | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certifi... | 2026-11-04 |
| CVE-2026-114639 | high | 8.7 | No | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Aut... | 2026-11-04 |
| CVE-2026-114635 | high | 8.7 | No | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS stat... | 2026-11-04 |
| CVE-2026-113952 | medium | 5.4 | No | A logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2... | 2026-11-04 |
| CVE-2026-113948 | medium | 5.5 | No | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify... | 2026-11-04 |
| CVE-2026-113944 | high | 7.1 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to caus... | 2026-11-04 |
| CVE-2026-112705 | medium | 5.5 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and... | 2026-11-04 |
| CVE-2026-112692 | medium | 5.5 | No | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watc... | 2026-11-04 |