Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65625 | not reported | — | No | The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itsel... | 2026-11-02 |
| CVE-2026-112655 | high | 8.8 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-02 |
| CVE-2026-58496 | medium | 4.3 | No | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` f... | 2026-11-02 |
| CVE-2026-58257 | high | 7.2 | No | GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration featu... | 2026-11-02 |
| CVE-2026-57198 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.... | 2026-11-02 |
| CVE-2026-57197 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-57191 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-57195 | high | 7.5 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-57194 | medium | 5.9 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |
| CVE-2026-54462 | medium | 6.5 | No | Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/web... | 2026-11-02 |
| CVE-2026-120497 | medium | 5.0 | No | Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might... | 2026-11-02 |
| CVE-2026-120067 | medium | 5.9 | No | For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copie... | 2026-11-02 |
| CVE-2026-120338 | critical | 10.0 | No | Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feat... | 2026-11-02 |
| CVE-2026-120308 | critical | 9.9 | No | A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the share... | 2026-11-02 |
| CVE-2026-120307 | critical | 9.9 | No | The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into... | 2026-11-02 |
| CVE-2026-120306 | critical | 9.9 | No | Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The... | 2026-11-02 |
| CVE-2026-120066 | medium | 5.3 | No | On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, an... | 2026-11-02 |
| CVE-2026-120065 | high | 7.1 | No | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It pla... | 2026-11-02 |
| CVE-2026-120064 | high | 7.5 | No | Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol wit... | 2026-11-02 |
| CVE-2026-120063 | medium | 5.9 | No | When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the... | 2026-11-02 |