Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117891 | high | 7.3 | No | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,... | 2026-11-04 |
| CVE-2026-117890 | high | 7.3 | No | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,... | 2026-11-04 |
| CVE-2026-117889 | high | 7.3 | No | Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox E... | 2026-11-04 |
| CVE-2026-114627 | not reported | — | No | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTM... | 2026-11-04 |
| CVE-2026-117888 | medium | 5.4 | No | Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, a... | 2026-11-04 |
| CVE-2026-116819 | high | 8.5 | No | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integrati... | 2026-11-04 |
| CVE-2026-116814 | medium | 6.5 | No | OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standa... | 2026-11-04 |
| CVE-2026-116810 | medium | 5.3 | No | OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotation... | 2026-11-04 |
| CVE-2026-116184 | not reported | — | No | OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms bec... | 2026-11-04 |
| CVE-2026-113783 | high | 7.4 | No | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resol... | 2026-11-04 |
| CVE-2026-113782 | high | 7.1 | No | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThr... | 2026-11-04 |
| CVE-2026-113780 | critical | 9.3 | No | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in... | 2026-11-04 |
| CVE-2026-107846 | not reported | — | No | bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Me... | 2026-11-04 |
| CVE-2026-102345 | not reported | — | No | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket art... | 2026-11-04 |
| CVE-2026-102704 | medium | 4.4 | No | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common a... | 2026-11-04 |
| CVE-2026-102703 | medium | 4.4 | No | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common a... | 2026-11-04 |
| CVE-2026-116245 | critical | 9.6 | No | libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a pas... | 2026-11-04 |
| CVE-2026-120651 | not reported | — | No | CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD or... | 2026-11-04 |
| CVE-2026-120650 | not reported | — | No | CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.... | 2026-11-04 |
| CVE-2026-120648 | not reported | — | No | CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between without escaping, s... | 2026-11-04 |