Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121397 | medium | 4.3 | No | FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak clien... | 2026-11-03 |
| CVE-2026-121260 | critical | 9.1 | No | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/l... | 2026-11-03 |
| CVE-2026-119485 | medium | 5.3 | No | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-11-03 |
| CVE-2026-119282 | not reported | — | No | Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22... | 2026-11-03 |
| CVE-2026-119279 | medium | 5.9 | No | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5... | 2026-11-03 |
| CVE-2026-119210 | medium | 5.9 | No | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5... | 2026-11-03 |
| CVE-2026-119206 | medium | 5.5 | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a craft... | 2026-11-03 |
| CVE-2026-119202 | high | 7.5 | No | @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expres... | 2026-11-03 |
| CVE-2026-119198 | medium | 5.9 | No | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development... | 2026-11-03 |
| CVE-2026-119194 | high | 7.5 | No | pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet... | 2026-11-03 |
| CVE-2026-119189 | medium | 5.9 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an... | 2026-11-03 |
| CVE-2026-119085 | high | 8.8 | No | Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (V... | 2026-11-03 |
| CVE-2026-118959 | medium | 5.4 | No | A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_actio... | 2026-11-03 |
| CVE-2026-119144 | high | 8.8 | No | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled mes... | 2026-11-03 |
| CVE-2026-118782 | high | 7.5 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a P... | 2026-11-03 |
| CVE-2026-118778 | medium | 5.9 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa... | 2026-11-03 |
| CVE-2026-118768 | not reported | — | No | Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's... | 2026-11-03 |
| CVE-2026-118764 | not reported | — | No | minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.... | 2026-11-03 |
| CVE-2026-118760 | medium | 6.5 | No | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend ar... | 2026-11-03 |
| CVE-2026-117184 | high | 7.5 | No | An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to t... | 2026-11-03 |