Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120636 | not reported | — | No | CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-abs... | 2026-11-04 |
| CVE-2026-120635 | not reported | — | No | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.... | 2026-11-04 |
| CVE-2026-120634 | not reported | — | No | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings... | 2026-11-04 |
| CVE-2026-120633 | not reported | — | No | CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the... | 2026-11-04 |
| CVE-2026-120632 | not reported | — | No | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST C... | 2026-11-04 |
| CVE-2026-120631 | not reported | — | No | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. C... | 2026-11-04 |
| CVE-2026-116246 | high | 7.6 | No | To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's... | 2026-11-04 |
| CVE-2026-116247 | critical | 9.6 | No | When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAd... | 2026-11-04 |
| CVE-2026-9212 | high | 8.0 | No | Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands... | 2026-11-04 |
| CVE-2026-87086 | high | 7.5 | No | Tanium addressed a denial of service vulnerability in Provision. | 2026-11-04 |
| CVE-2026-87897 | medium | 4.6 | No | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for anot... | 2026-11-04 |
| CVE-2026-58115 | critical | 10.0 | No | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions | 2026-11-04 |
| CVE-2026-58949 | high | 7.5 | No | In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead... | 2026-11-04 |
| CVE-2026-58814 | high | 7.5 | No | In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of... | 2026-11-04 |
| CVE-2026-82986 | medium | 4.6 | No | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though t... | 2026-11-04 |
| CVE-2026-82983 | low | 3.3 | No | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe... | 2026-11-04 |
| CVE-2026-77172 | medium | 5.3 | No | App passwords were allowed to bypass password confirmation on sensitive endpoints. | 2026-11-04 |
| CVE-2026-57853 | high | 8.8 | No | DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template... | 2026-11-04 |
| CVE-2026-55292 | medium | 5.3 | No | In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information dis... | 2026-11-04 |
| CVE-2026-49912 | medium | 4.0 | No | In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in... | 2026-11-04 |