Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118654 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve... | 2026-11-02 |
| CVE-2026-118653 | medium | 5.3 | No | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Ec... | 2026-11-02 |
| CVE-2026-118650 | high | 7.5 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path d... | 2026-11-02 |
| CVE-2026-118647 | high | 8.2 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, becaus... | 2026-11-02 |
| CVE-2026-118643 | high | 8.2 | No | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in t... | 2026-11-02 |
| CVE-2026-118425 | medium | 6.8 | No | A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occur... | 2026-11-02 |
| CVE-2026-118259 | medium | 5.3 | No | opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by t... | 2026-11-02 |
| CVE-2026-118255 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits lin... | 2026-11-02 |
| CVE-2026-118251 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the win... | 2026-11-02 |
| CVE-2026-118247 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcha... | 2026-11-02 |
| CVE-2026-118243 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and st... | 2026-11-02 |
| CVE-2026-117681 | high | 8.0 | No | A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transpor... | 2026-11-02 |
| CVE-2026-117688 | medium | 5.3 | No | A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault prov... | 2026-11-02 |
| CVE-2026-116795 | high | 7.5 | No | RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBE... | 2026-11-02 |
| CVE-2026-115700 | not reported | — | No | Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed I... | 2026-11-02 |
| CVE-2026-115424 | medium | 5.5 | No | A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly... | 2026-11-02 |
| CVE-2026-114217 | high | 8.6 | No | A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runn... | 2026-11-02 |
| CVE-2026-110314 | not reported | — | No | Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client... | 2026-11-02 |
| CVE-2026-104067 | high | 7.8 | No | Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to veri... | 2026-11-02 |
| CVE-2026-104066 | high | 7.8 | No | Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin whe... | 2026-11-02 |