Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113783 | high | 7.4 | No | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resol... | 2026-11-04 |
| CVE-2026-113782 | high | 7.1 | No | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThr... | 2026-11-04 |
| CVE-2026-107846 | not reported | — | No | bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Me... | 2026-11-04 |
| CVE-2026-102345 | not reported | — | No | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket art... | 2026-11-04 |
| CVE-2026-120651 | not reported | — | No | CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD or... | 2026-11-04 |
| CVE-2026-120650 | not reported | — | No | CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.... | 2026-11-04 |
| CVE-2026-120648 | not reported | — | No | CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between without escaping, s... | 2026-11-04 |
| CVE-2026-120647 | not reported | — | No | CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenam... | 2026-11-04 |
| CVE-2026-120646 | not reported | — | No | CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.... | 2026-11-04 |
| CVE-2026-120645 | not reported | — | No | CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. Wh... | 2026-11-04 |
| CVE-2026-120644 | not reported | — | No | CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domai... | 2026-11-04 |
| CVE-2026-120643 | not reported | — | No | CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both pass... | 2026-11-04 |
| CVE-2026-120642 | not reported | — | No | CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pa... | 2026-11-04 |
| CVE-2026-120641 | not reported | — | No | CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned... | 2026-11-04 |
| CVE-2026-120640 | not reported | — | No | CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form... | 2026-11-04 |
| CVE-2026-120639 | not reported | — | No | CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in... | 2026-11-04 |
| CVE-2026-120638 | not reported | — | No | CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redire... | 2026-11-04 |
| CVE-2026-120637 | not reported | — | No | CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a... | 2026-11-04 |
| CVE-2026-120636 | not reported | — | No | CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-abs... | 2026-11-04 |
| CVE-2026-120635 | not reported | — | No | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.... | 2026-11-04 |