Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121589 | medium | 5.3 | No | A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUr... | 2026-11-04 |
| CVE-2026-121585 | medium | 4.3 | No | A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engi... | 2026-11-04 |
| CVE-2026-46633 | critical | 9.8 | No | Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a templat... | 2026-11-04 |
| CVE-2026-118628 | high | 8.2 | No | MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclos... | 2026-11-04 |
| CVE-2026-114552 | medium | 6.5 | No | MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attacke... | 2026-11-04 |
| CVE-2026-114551 | medium | 5.9 | No | MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf... | 2026-11-04 |
| CVE-2026-114550 | high | 8.1 | No | libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote... | 2026-11-04 |
| CVE-2026-114549 | critical | 9.8 | No | NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute... | 2026-11-04 |
| CVE-2024-50330 | critical | 9.8 | No | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthent... | 2026-11-04 |
| CVE-2024-45409 | critical | 9.8 | No | The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in | 2026-11-04 |
| CVE-2024-43102 | critical | 10.0 | No | Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreas... | 2026-11-04 |
| CVE-2024-41730 | critical | 9.8 | No | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can... | 2026-11-04 |
| CVE-2024-36984 | high | 8.8 | No | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that... | 2026-11-04 |
| CVE-2024-31449 | high | 8.8 | No | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a... | 2026-11-04 |
| CVE-2024-29847 | critical | 9.8 | No | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenti... | 2026-11-04 |
| CVE-2024-23471 | high | 8.8 | No | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability... | 2026-11-04 |
| CVE-2024-23467 | high | 8.8 | No | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability a... | 2026-11-04 |
| CVE-2024-27820 | high | 8.8 | No | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS... | 2026-11-04 |
| CVE-2024-10914 | critical | 9.8 | No | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by t... | 2026-11-04 |
| CVE-2026-96219 | critical | 9.8 | No | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a net... | 2026-11-03 |