Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-41242 | critical | 9.8 | No | protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject... | 2026-11-03 |
| CVE-2026-121631 | medium | 4.2 | No | Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with u... | 2026-11-03 |
| CVE-2026-121588 | medium | 6.1 | No | TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying... | 2026-11-03 |
| CVE-2026-121560 | high | 7.1 | No | LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any othe... | 2026-11-03 |
| CVE-2026-121556 | high | 8.3 | No | FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users... | 2026-11-03 |
| CVE-2026-121552 | medium | 4.3 | No | Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows auth... | 2026-11-03 |
| CVE-2026-121548 | high | 7.8 | No | Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafte... | 2026-11-03 |
| CVE-2026-121544 | medium | 4.9 | No | Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated... | 2026-11-03 |
| CVE-2026-121453 | low | 2.7 | No | SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators... | 2026-11-03 |
| CVE-2026-121449 | medium | 6.5 | No | Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as re... | 2026-11-03 |
| CVE-2026-121445 | medium | 5.9 | No | darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of... | 2026-11-03 |
| CVE-2026-121441 | low | 3.7 | No | Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows... | 2026-11-03 |
| CVE-2026-121437 | high | 7.5 | No | Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-tim... | 2026-11-03 |
| CVE-2026-121433 | medium | 5.4 | No | AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist for... | 2026-11-03 |
| CVE-2026-121429 | high | 8.8 | No | AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands... | 2026-11-03 |
| CVE-2026-121425 | medium | 6.5 | No | Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted displa... | 2026-11-03 |
| CVE-2026-121421 | medium | 4.3 | No | SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --den... | 2026-11-03 |
| CVE-2026-121262 | medium | 5.3 | No | A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/Explai... | 2026-11-03 |
| CVE-2026-121417 | high | 7.8 | No | SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affin... | 2026-11-03 |
| CVE-2026-121401 | medium | 4.3 | No | FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without ve... | 2026-11-03 |