Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117563 | medium | 5.4 | No | MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to... | 2026-11-02 |
| CVE-2026-117559 | high | 7.8 | No | DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(... | 2026-11-02 |
| CVE-2026-117555 | medium | 6.1 | No | CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in t... | 2026-11-02 |
| CVE-2026-117536 | high | 8.8 | No | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the C... | 2026-11-02 |
| CVE-2026-117514 | high | 7.3 | No | A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_... | 2026-11-02 |
| CVE-2026-117513 | high | 7.3 | No | A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_sea... | 2026-11-02 |
| CVE-2026-117511 | high | 7.3 | No | A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/t... | 2026-11-02 |
| CVE-2026-117510 | medium | 6.3 | No | A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbo... | 2026-11-02 |
| CVE-2026-117507 | medium | 5.4 | No | A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. Th... | 2026-11-02 |
| CVE-2026-116696 | low | 3.3 | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::serve... | 2026-11-02 |
| CVE-2026-116692 | critical | 9.8 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0... | 2026-11-02 |
| CVE-2026-116688 | high | 8.1 | No | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerab... | 2026-11-02 |
| CVE-2026-117506 | medium | 4.3 | No | A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setIn... | 2026-11-02 |
| CVE-2026-117504 | medium | 5.3 | No | A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/d... | 2026-11-02 |
| CVE-2026-116684 | medium | 6.8 | No | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 an... | 2026-11-02 |
| CVE-2026-116682 | high | 8.6 | No | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/... | 2026-11-02 |
| CVE-2026-116677 | not reported | — | No | OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 unt... | 2026-11-02 |
| CVE-2026-116674 | medium | 6.5 | No | systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, O... | 2026-11-02 |
| CVE-2026-115930 | medium | 6.8 | No | The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate sto... | 2026-11-02 |
| CVE-2026-115693 | not reported | — | No | Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to... | 2026-11-02 |