Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121603 | medium | 6.5 | No | Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory b... | 2026-11-03 |
| CVE-2026-121578 | medium | 6.1 | No | Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/Jav... | 2026-11-03 |
| CVE-2026-121564 | not reported | — | No | Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in what... | 2026-11-03 |
| CVE-2026-121413 | low | 3.1 | No | Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates... | 2026-11-03 |
| CVE-2026-121409 | medium | 5.9 | No | FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or... | 2026-11-03 |
| CVE-2026-121405 | medium | 4.3 | No | FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger exces... | 2026-11-03 |
| CVE-2026-119495 | medium | 5.3 | No | Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Securi... | 2026-11-03 |
| CVE-2026-119487 | medium | 5.3 | No | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-11-03 |
| CVE-2026-119215 | not reported | — | No | Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a... | 2026-11-03 |
| CVE-2026-118505 | not reported | — | No | Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacke... | 2026-11-03 |
| CVE-2026-118488 | medium | 5.9 | No | In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not len... | 2026-11-03 |
| CVE-2026-114185 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-el... | 2026-11-03 |
| CVE-2026-113937 | medium | 5.5 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to caus... | 2026-11-03 |
| CVE-2026-111211 | medium | 5.3 | No | An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometry... | 2026-11-03 |
| CVE-2026-110265 | medium | 6.5 | No | A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environ... | 2026-11-03 |
| CVE-2026-110748 | medium | 5.5 | No | This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened thes... | 2026-11-03 |
| CVE-2026-0980 | high | 8.8 | No | A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attac... | 2026-11-03 |
| CVE-2026-100493 | not reported | — | No | An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an u... | 2026-11-03 |
| CVE-2025-71434 | high | 8.2 | No | Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endp... | 2026-11-03 |
| CVE-2024-6538 | medium | 5.3 | No | A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL t... | 2026-11-03 |