Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51954 | high | 8.1 | No | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL wit... | 2026-11-02 |
| CVE-2026-51831 | high | 7.8 | No | An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to ex... | 2026-11-02 |
| CVE-2026-117540 | high | 7.5 | No | svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole... | 2026-11-02 |
| CVE-2026-117532 | critical | 9.8 | No | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthentic... | 2026-11-02 |
| CVE-2026-116897 | medium | 6.5 | No | REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview mod... | 2026-11-02 |
| CVE-2026-116893 | medium | 6.8 | No | REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend use... | 2026-11-02 |
| CVE-2026-116889 | medium | 6.1 | No | SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to in... | 2026-11-02 |
| CVE-2026-116843 | high | 8.8 | No | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter driver... | 2026-11-02 |
| CVE-2026-116829 | medium | 6.6 | No | llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor el... | 2026-11-02 |
| CVE-2026-116825 | medium | 6.5 | No | YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or... | 2026-11-02 |
| CVE-2026-116821 | medium | 6.5 | No | YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns wit... | 2026-11-02 |
| CVE-2026-116817 | medium | 6.5 | No | OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashbo... | 2026-11-02 |
| CVE-2026-116812 | medium | 6.5 | No | OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members t... | 2026-11-02 |
| CVE-2026-116808 | high | 7.2 | No | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a craf... | 2026-11-02 |
| CVE-2026-116804 | medium | 6.1 | No | DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow... | 2026-11-02 |
| CVE-2026-116800 | medium | 6.2 | No | WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside t... | 2026-11-02 |
| CVE-2026-116745 | medium | 6.5 | No | QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated at... | 2026-11-02 |
| CVE-2026-116741 | medium | 6.5 | No | Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishan... | 2026-11-02 |
| CVE-2026-116737 | medium | 6.1 | No | libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the dire... | 2026-11-02 |
| CVE-2026-116733 | low | 3.7 | No | flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the inpu... | 2026-11-02 |