Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-44007 | critical | 9.1 | No | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally... | 2026-11-04 |
| CVE-2026-39892 | critical | 9.8 | No | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a n... | 2026-11-04 |
| CVE-2026-121802 | critical | 9.1 | No | @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), bec... | 2026-11-04 |
| CVE-2026-121618 | medium | 5.3 | No | A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory... | 2026-11-04 |
| CVE-2026-121617 | high | 7.5 | No | A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/up... | 2026-11-04 |
| CVE-2026-121616 | medium | 5.3 | No | A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_lo... | 2026-11-04 |
| CVE-2026-121615 | critical | 10.0 | No | A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the compone... | 2026-11-04 |
| CVE-2026-119415 | low | 3.7 | No | CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsani... | 2026-11-04 |
| CVE-2026-62374 | not reported | — | No | SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/dec... | 2026-11-04 |
| CVE-2026-93009 | medium | 4.3 | No | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the... | 2026-11-04 |
| CVE-2026-121610 | high | 7.3 | No | A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the com... | 2026-11-04 |
| CVE-2026-121609 | critical | 10.0 | No | A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/m... | 2026-11-04 |
| CVE-2026-121608 | high | 7.3 | No | A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message o... | 2026-11-04 |
| CVE-2026-61673 | not reported | — | No | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/l... | 2026-11-04 |
| CVE-2026-45049 | high | 8.3 | No | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allow... | 2026-11-04 |
| CVE-2026-121607 | critical | 10.0 | No | A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file... | 2026-11-04 |
| CVE-2026-119407 | high | 7.1 | No | Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthe... | 2026-11-04 |
| CVE-2026-119376 | medium | 5.5 | No | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining... | 2026-11-04 |
| CVE-2026-119372 | medium | 5.5 | No | SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() ca... | 2026-11-04 |
| CVE-2026-119285 | medium | 5.9 | No | Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in... | 2026-11-04 |