Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121964 | high | 7.5 | No | FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and... | 2026-11-04 |
| CVE-2026-121993 | medium | 4.3 | No | wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route... | 2026-11-04 |
| CVE-2026-121970 | low | 3.7 | No | Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerabilit... | 2026-11-04 |
| CVE-2026-121946 | high | 7.2 | No | zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that... | 2026-11-04 |
| CVE-2026-121945 | high | 7.6 | No | CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incide... | 2026-11-04 |
| CVE-2026-121944 | medium | 5.5 | No | sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause de... | 2026-11-04 |
| CVE-2026-121943 | medium | 4.8 | No | Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off... | 2026-11-04 |
| CVE-2026-121942 | medium | 6.1 | No | ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap m... | 2026-11-04 |
| CVE-2026-121940 | high | 8.8 | No | Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access o... | 2026-11-04 |
| CVE-2026-121939 | high | 8.1 | No | Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identiti... | 2026-11-04 |
| CVE-2026-121938 | medium | 5.3 | No | langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other... | 2026-11-04 |
| CVE-2026-121932 | critical | 10.0 | No | A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manip... | 2026-11-04 |
| CVE-2026-121931 | critical | 9.1 | No | A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of... | 2026-11-04 |
| CVE-2026-121930 | critical | 9.1 | No | A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the componen... | 2026-11-04 |
| CVE-2026-121937 | low | 3.1 | No | loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read ot... | 2026-11-04 |
| CVE-2026-121936 | medium | 6.5 | No | easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send P... | 2026-11-04 |
| CVE-2026-121929 | low | 3.5 | No | A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.ph... | 2026-11-04 |
| CVE-2026-121928 | low | 3.5 | No | A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_uti... | 2026-11-04 |
| CVE-2026-121733 | medium | 5.4 | No | Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the R... | 2026-11-04 |
| CVE-2026-121729 | high | 8.3 | No | emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authen... | 2026-11-04 |