Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112326 | low | 3.1 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that,... | 2026-11-04 |
| CVE-2026-112212 | high | 7.5 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th... | 2026-11-04 |
| CVE-2026-110264 | critical | 10.0 | No | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2... | 2026-11-04 |
| CVE-2026-105777 | medium | 6.5 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1... | 2026-11-04 |
| CVE-2026-105711 | low | 3.5 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th... | 2026-11-04 |
| CVE-2026-103515 | low | 2.7 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that,... | 2026-11-04 |
| CVE-2026-111932 | low | 3.4 | No | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability be... | 2026-11-04 |
| CVE-2026-111927 | high | 7.7 | No | Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in... | 2026-11-04 |
| CVE-2026-97693 | critical | 9.9 | No | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there i... | 2026-11-04 |
| CVE-2026-58128 | medium | 6.2 | No | Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious appl... | 2026-11-04 |
| CVE-2026-55368 | high | 8.1 | No | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-l... | 2026-11-04 |
| CVE-2026-54379 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-11-04 |
| CVE-2026-39743 | medium | 5.3 | No | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access C... | 2026-11-04 |
| CVE-2026-38595 | critical | 9.8 | No | An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted file... | 2026-11-04 |
| CVE-2026-1761 | high | 8.6 | No | A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an... | 2026-11-04 |
| CVE-2026-1933 | medium | 6.5 | No | A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access... | 2026-11-04 |
| CVE-2026-18157 | high | 7.8 | No | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injectio... | 2026-11-04 |
| CVE-2026-1584 | high | 7.5 | No | A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello mes... | 2026-11-04 |
| CVE-2026-18453 | high | 7.5 | No | A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthent... | 2026-11-04 |
| CVE-2026-18355 | high | 7.5 | No | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-re... | 2026-11-04 |