Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118371 | low | 3.7 | No | LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which wri... | 2026-11-03 |
| CVE-2026-118274 | medium | 4.3 | No | A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers... | 2026-11-03 |
| CVE-2026-118271 | medium | 4.3 | No | A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_cor... | 2026-11-03 |
| CVE-2026-118242 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from renderin... | 2026-11-03 |
| CVE-2026-117608 | medium | 6.1 | No | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table... | 2026-11-03 |
| CVE-2026-116775 | not reported | — | No | pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant... | 2026-11-03 |
| CVE-2026-116695 | not reported | — | No | Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing p... | 2026-11-03 |
| CVE-2026-116691 | medium | 6.5 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, m... | 2026-11-03 |
| CVE-2026-117526 | medium | 5.3 | No | A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remote... | 2026-11-03 |
| CVE-2026-115904 | critical | 9.6 | No | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-control... | 2026-11-03 |
| CVE-2026-116687 | low | 3.1 | No | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup c... | 2026-11-03 |
| CVE-2026-116683 | not reported | — | No | CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive v... | 2026-11-03 |
| CVE-2025-49521 | high | 8.8 | No | A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as... | 2026-11-03 |
| CVE-2025-49520 | high | 8.8 | No | A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote com... | 2026-11-03 |
| CVE-2026-106971 | high | 7.5 | No | An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a deni... | 2026-11-03 |
| CVE-2015-20129 | high | 8.8 | No | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CS... | 2026-11-03 |
| CVE-2013-20009 | medium | 4.8 | No | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts v... | 2026-11-03 |
| CVE-2026-101708 | high | 7.5 | No | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affecte... | 2026-11-03 |
| CVE-2026-101709 | medium | 5.4 | No | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affecte... | 2026-11-03 |
| CVE-2026-101710 | medium | 6.8 | No | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affecte... | 2026-11-03 |