Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107035 | medium | 6.5 | No | Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers t... | 2026-11-03 |
| CVE-2026-107029 | critical | 9.1 | No | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data acce... | 2026-11-03 |
| CVE-2026-107024 | high | 7.5 | No | Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard... | 2026-11-03 |
| CVE-2026-107018 | high | 8.1 | No | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files insid... | 2026-11-03 |
| CVE-2026-40895 | high | 7.5 | No | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to... | 2026-11-03 |
| CVE-2026-118757 | medium | 6.5 | No | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_... | 2026-11-03 |
| CVE-2026-118753 | high | 7.8 | No | FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that al... | 2026-11-03 |
| CVE-2026-118692 | high | 7.0 | No | CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands... | 2026-11-03 |
| CVE-2026-118682 | high | 7.5 | No | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept... | 2026-11-03 |
| CVE-2026-118666 | not reported | — | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy W... | 2026-11-03 |
| CVE-2026-118662 | not reported | — | No | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before... | 2026-11-03 |
| CVE-2026-63667 | medium | 6.5 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/fo... | 2026-11-02 |
| CVE-2026-40176 | high | 7.8 | No | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the... | 2026-11-02 |
| CVE-2026-33762 | low | 2.8 | No | go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4... | 2026-11-02 |
| CVE-2026-111565 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-11-02 |
| CVE-2023-7008 | medium | 5.9 | No | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when th... | 2026-11-02 |
| CVE-2023-49646 | medium | 6.5 | No | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via networ... | 2026-11-02 |
| CVE-2023-5197 | medium | 6.6 | No | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.... | 2026-11-02 |
| CVE-2023-46751 | high | 7.5 | No | An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to c... | 2026-11-02 |
| CVE-2023-41140 | high | 7.8 | No | A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malic... | 2026-11-02 |