Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118675 | high | 7.1 | No | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use rest... | 2026-11-04 |
| CVE-2026-118377 | high | 7.5 | No | mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to for... | 2026-11-04 |
| CVE-2026-118027 | critical | 9.1 | No | Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | 2026-11-04 |
| CVE-2026-117929 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117928 | high | 8.1 | No | Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thun... | 2026-11-04 |
| CVE-2026-117921 | high | 8.8 | No | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 15... | 2026-11-04 |
| CVE-2026-117920 | critical | 9.6 | No | Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thund... | 2026-11-04 |
| CVE-2026-117919 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117918 | high | 8.8 | No | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thun... | 2026-11-04 |
| CVE-2026-116662 | high | 7.5 | No | Tanium addressed a compression bomb vulnerability in Enforce. | 2026-11-04 |
| CVE-2026-116659 | medium | 4.3 | No | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 2026-11-04 |
| CVE-2026-116657 | medium | 5.3 | No | Tanium addressed a denial of service vulnerability in Enforce. | 2026-11-04 |
| CVE-2026-117917 | critical | 9.8 | No | Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Th... | 2026-11-04 |
| CVE-2026-117466 | not reported | — | No | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. | 2026-11-04 |
| CVE-2026-117341 | not reported | — | No | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is... | 2026-11-04 |
| CVE-2026-116376 | low | 3.4 | No | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redire... | 2026-11-04 |
| CVE-2026-115762 | medium | 6.1 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vul... | 2026-11-04 |
| CVE-2026-115758 | not reported | — | No | SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INT... | 2026-11-04 |
| CVE-2026-116656 | high | 7.5 | No | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 2026-11-04 |
| CVE-2026-116214 | critical | 9.1 | No | MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's... | 2026-11-04 |