Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121929 | low | 3.5 | No | A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.ph... | 2026-11-04 |
| CVE-2026-121928 | low | 3.5 | No | A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_uti... | 2026-11-04 |
| CVE-2026-121733 | medium | 5.4 | No | Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the R... | 2026-11-04 |
| CVE-2026-121729 | high | 8.3 | No | emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authen... | 2026-11-04 |
| CVE-2026-121640 | not reported | — | No | An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate re... | 2026-11-04 |
| CVE-2026-121639 | not reported | — | No | A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with n... | 2026-11-04 |
| CVE-2026-121638 | not reported | — | No | An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to inte... | 2026-11-04 |
| CVE-2026-121637 | not reported | — | No | An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who... | 2026-11-04 |
| CVE-2026-121632 | not reported | — | No | Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. process_attrs writes each... | 2026-11-04 |
| CVE-2026-121620 | medium | 6.5 | No | CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Z... | 2026-11-04 |
| CVE-2026-121598 | critical | 9.9 | No | A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/... | 2026-11-04 |
| CVE-2026-121373 | not reported | — | No | The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content at... | 2026-11-04 |
| CVE-2026-121583 | medium | 6.3 | No | A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-par... | 2026-11-04 |
| CVE-2026-121535 | low | 3.7 | No | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file ap... | 2026-11-04 |
| CVE-2026-121542 | not reported | — | No | In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the... | 2026-11-04 |
| CVE-2026-121254 | medium | 6.5 | No | Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted H... | 2026-11-04 |
| CVE-2026-121245 | medium | 5.3 | No | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via... | 2026-11-04 |
| CVE-2026-121243 | medium | 6.5 | No | Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted H... | 2026-11-04 |
| CVE-2026-121235 | medium | 6.5 | No | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HT... | 2026-11-04 |
| CVE-2026-121232 | medium | 5.1 | No | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sen... | 2026-11-04 |