Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118682 | high | 7.5 | No | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept... | 2026-11-03 |
| CVE-2026-118666 | not reported | — | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy W... | 2026-11-03 |
| CVE-2026-118662 | not reported | — | No | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before... | 2026-11-03 |
| CVE-2026-63667 | medium | 6.5 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/fo... | 2026-11-02 |
| CVE-2026-40176 | high | 7.8 | No | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the... | 2026-11-02 |
| CVE-2026-33762 | low | 2.8 | No | go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4... | 2026-11-02 |
| CVE-2026-111565 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-11-02 |
| CVE-2023-7008 | medium | 5.9 | No | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when th... | 2026-11-02 |
| CVE-2023-49646 | medium | 6.5 | No | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via networ... | 2026-11-02 |
| CVE-2023-5197 | medium | 6.6 | No | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.... | 2026-11-02 |
| CVE-2023-46751 | high | 7.5 | No | An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to c... | 2026-11-02 |
| CVE-2023-41140 | high | 7.8 | No | A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malic... | 2026-11-02 |
| CVE-2023-36049 | critical | 9.8 | No | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability | 2026-11-02 |
| CVE-2023-45862 | medium | 5.5 | No | An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object cou... | 2026-11-02 |
| CVE-2023-39214 | high | 8.1 | No | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via netwo... | 2026-11-02 |
| CVE-2023-36009 | medium | 5.5 | No | Microsoft Word Information Disclosure Vulnerability | 2026-11-02 |
| CVE-2023-30588 | medium | 5.3 | No | When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs maki... | 2026-11-02 |
| CVE-2023-29074 | critical | 9.8 | No | A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicio... | 2026-11-02 |
| CVE-2023-29073 | critical | 9.8 | No | A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A mal... | 2026-11-02 |
| CVE-2023-32558 | high | 7.5 | No | The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all u... | 2026-11-02 |