Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121432 | low | 3.5 | No | AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedd... | 2026-11-03 |
| CVE-2026-121458 | medium | 6.5 | No | Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authentica... | 2026-11-03 |
| CVE-2026-121428 | high | 8.8 | No | AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor conf... | 2026-11-03 |
| CVE-2026-121424 | medium | 6.5 | No | Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect reci... | 2026-11-03 |
| CVE-2026-121420 | low | 3.3 | No | SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fai... | 2026-11-03 |
| CVE-2026-121416 | high | 7.1 | No | SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because Meth... | 2026-11-03 |
| CVE-2026-121412 | medium | 6.5 | No | FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain... | 2026-11-03 |
| CVE-2026-121408 | medium | 5.3 | No | FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer with... | 2026-11-03 |
| CVE-2026-121404 | medium | 6.5 | No | FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server t... | 2026-11-03 |
| CVE-2026-121400 | medium | 6.5 | No | FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust... | 2026-11-03 |
| CVE-2026-120971 | medium | 5.3 | No | A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by... | 2026-11-03 |
| CVE-2026-120575 | medium | 6.4 | No | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name'... | 2026-11-03 |
| CVE-2026-120574 | high | 8.1 | No | The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwor... | 2026-11-03 |
| CVE-2026-120558 | high | 7.2 | No | The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of... | 2026-11-03 |
| CVE-2026-120597 | medium | 4.3 | No | A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_mes... | 2026-11-03 |
| CVE-2026-120333 | not reported | — | No | The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with... | 2026-11-03 |
| CVE-2026-120332 | not reported | — | No | The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can in... | 2026-11-03 |
| CVE-2026-120331 | not reported | — | No | Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend us... | 2026-11-03 |
| CVE-2026-120552 | medium | 6.4 | No | The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-11-03 |
| CVE-2026-120534 | critical | 9.8 | No | The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including,... | 2026-11-03 |