Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120489 | medium | 4.3 | No | Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to p... | 2026-11-02 |
| CVE-2026-120457 | medium | 5.3 | No | libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed... | 2026-11-02 |
| CVE-2026-120453 | low | 3.3 | No | The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the d... | 2026-11-02 |
| CVE-2026-120452 | medium | 5.4 | No | libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cam... | 2026-11-02 |
| CVE-2026-120449 | medium | 5.3 | No | Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents beca... | 2026-11-02 |
| CVE-2026-120440 | medium | 5.3 | No | QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when... | 2026-11-02 |
| CVE-2026-120309 | low | 3.7 | No | Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers re... | 2026-11-02 |
| CVE-2026-120245 | medium | 5.5 | No | FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decod... | 2026-11-02 |
| CVE-2026-120244 | medium | 5.5 | No | FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory... | 2026-11-02 |
| CVE-2026-63393 | not reported | — | No | OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and t... | 2026-11-02 |
| CVE-2026-111578 | high | 7.5 | No | The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-suppli... | 2026-11-02 |
| CVE-2026-62864 | high | 7.5 | No | Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.mid... | 2026-11-02 |
| CVE-2026-95664 | medium | 5.4 | No | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apac... | 2026-11-02 |
| CVE-2026-88809 | high | 7.6 | No | A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests... | 2026-11-02 |
| CVE-2026-90717 | critical | 9.1 | No | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1... | 2026-11-02 |
| CVE-2026-67186 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-11-02 |
| CVE-2026-70388 | high | 8.3 | No | SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cau... | 2026-11-02 |
| CVE-2026-63115 | medium | 5.3 | No | ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote fe... | 2026-11-02 |
| CVE-2026-62991 | medium | 6.5 | No | Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/... | 2026-11-02 |
| CVE-2026-57187 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-02 |