Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13271 | high | 8.1 | No | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 th... | 2026-11-04 |
| CVE-2026-12550 | medium | 5.4 | No | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 th... | 2026-11-04 |
| CVE-2026-12538 | medium | 5.4 | No | IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive informati... | 2026-11-04 |
| CVE-2026-122235 | medium | 4.7 | No | Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files... | 2026-11-04 |
| CVE-2026-122234 | medium | 4.7 | No | jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped ar... | 2026-11-04 |
| CVE-2026-122233 | low | 3.7 | No | FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response heade... | 2026-11-04 |
| CVE-2026-122224 | high | 8.1 | No | WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach M... | 2026-11-04 |
| CVE-2026-122140 | medium | 5.8 | No | Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbo... | 2026-11-04 |
| CVE-2026-122139 | medium | 5.3 | No | blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unaut... | 2026-11-04 |
| CVE-2026-122138 | medium | 5.3 | No | BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-... | 2026-11-04 |
| CVE-2026-122137 | medium | 6.7 | No | Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses atta... | 2026-11-04 |
| CVE-2026-122136 | medium | 4.4 | No | Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite... | 2026-11-04 |
| CVE-2026-122135 | high | 8.8 | No | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configu... | 2026-11-04 |
| CVE-2026-122134 | high | 8.8 | No | Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git... | 2026-11-04 |
| CVE-2026-122013 | critical | 10.0 | No | A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/... | 2026-11-04 |
| CVE-2026-122009 | high | 7.3 | No | A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetU... | 2026-11-04 |
| CVE-2026-122008 | medium | 5.0 | No | Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that all... | 2026-11-04 |
| CVE-2026-122006 | critical | 9.8 | No | The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write opera... | 2026-11-04 |
| CVE-2026-121941 | high | 7.8 | No | libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write pas... | 2026-11-04 |
| CVE-2026-91537 | high | 7.8 | No | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily e... | 2026-11-04 |