Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119586 | high | 7.8 | No | SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-... | 2026-11-03 |
| CVE-2026-112545 | high | 7.8 | No | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.... | 2026-11-03 |
| CVE-2026-112548 | high | 7.8 | No | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, m... | 2026-11-03 |
| CVE-2026-112615 | medium | 4.3 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-03 |
| CVE-2026-92809 | medium | 4.3 | No | PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authen... | 2026-11-03 |
| CVE-2026-81648 | critical | 10.0 | No | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing... | 2026-11-03 |
| CVE-2026-121447 | medium | 6.1 | No | svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript:... | 2026-11-03 |
| CVE-2026-121443 | medium | 5.3 | No | svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submittin... | 2026-11-03 |
| CVE-2026-121439 | medium | 5.3 | No | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set... | 2026-11-03 |
| CVE-2026-121435 | medium | 4.3 | No | Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by callin... | 2026-11-03 |
| CVE-2026-121431 | medium | 5.3 | No | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass th... | 2026-11-03 |
| CVE-2026-121427 | high | 7.5 | No | AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage statio... | 2026-11-03 |
| CVE-2026-121423 | medium | 6.5 | No | SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by trigge... | 2026-11-03 |
| CVE-2026-121419 | high | 8.1 | No | SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access m... | 2026-11-03 |
| CVE-2026-121415 | low | 3.7 | No | Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowi... | 2026-11-03 |
| CVE-2026-107059 | high | 7.5 | No | An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker cont... | 2026-11-03 |
| CVE-2026-107053 | critical | 9.1 | No | Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in... | 2026-11-03 |
| CVE-2026-107048 | critical | 9.8 | No | An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via... | 2026-11-03 |
| CVE-2026-107043 | critical | 9.1 | No | Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mecha... | 2026-11-03 |
| CVE-2026-107038 | critical | 9.1 | No | Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading... | 2026-11-03 |