Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120062 | high | 7.5 | No | SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other c... | 2026-11-02 |
| CVE-2026-120061 | high | 7.5 | No | The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry sta... | 2026-11-02 |
| CVE-2026-120060 | medium | 5.9 | No | psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction... | 2026-11-02 |
| CVE-2026-120059 | medium | 6.8 | No | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by... | 2026-11-02 |
| CVE-2026-120058 | high | 7.5 | No | psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply w... | 2026-11-02 |
| CVE-2026-120057 | high | 7.5 | No | psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without compari... | 2026-11-02 |
| CVE-2026-119733 | high | 8.1 | No | Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/compa... | 2026-11-02 |
| CVE-2026-118871 | medium | 6.5 | No | SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged i... | 2026-11-02 |
| CVE-2026-118276 | low | 3.5 | No | A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers... | 2026-11-02 |
| CVE-2026-118378 | high | 7.8 | No | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements b... | 2026-11-02 |
| CVE-2026-118374 | medium | 5.9 | No | LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sendi... | 2026-11-02 |
| CVE-2026-118370 | high | 8.2 | No | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger ou... | 2026-11-02 |
| CVE-2026-118273 | medium | 4.3 | No | A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/... | 2026-11-02 |
| CVE-2026-117680 | not reported | — | No | Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauth... | 2026-11-02 |
| CVE-2026-117607 | high | 7.2 | No | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission t... | 2026-11-02 |
| CVE-2026-118129 | medium | 6.3 | No | A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function is... | 2026-11-02 |
| CVE-2026-117604 | high | 7.5 | No | Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated v... | 2026-11-02 |
| CVE-2026-117573 | high | 7.8 | No | hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting... | 2026-11-02 |
| CVE-2026-117516 | high | 7.3 | No | A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert... | 2026-11-02 |
| CVE-2026-117567 | high | 7.8 | No | esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying s... | 2026-11-02 |