Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117499 | low | 3.7 | No | @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that r... | 2026-11-04 |
| CVE-2026-116899 | medium | 6.5 | No | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categ... | 2026-11-04 |
| CVE-2026-116895 | medium | 5.4 | No | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.p... | 2026-11-04 |
| CVE-2026-116887 | medium | 5.4 | No | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to i... | 2026-11-04 |
| CVE-2026-116883 | medium | 4.8 | No | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to... | 2026-11-04 |
| CVE-2026-117494 | not reported | — | No | Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64.... | 2026-11-04 |
| CVE-2026-117493 | not reported | — | No | Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘... | 2026-11-04 |
| CVE-2026-113957 | medium | 5.6 | No | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pul... | 2026-11-04 |
| CVE-2026-115624 | medium | 5.3 | No | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi... | 2026-11-04 |
| CVE-2026-115408 | medium | 5.5 | No | In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, | 2026-11-04 |
| CVE-2026-116875 | medium | 6.1 | No | SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator pa... | 2026-11-04 |
| CVE-2026-116871 | high | 7.5 | No | Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that proces... | 2026-11-04 |
| CVE-2026-116870 | not reported | — | No | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from... | 2026-11-04 |
| CVE-2026-116188 | medium | 5.3 | No | rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses... | 2026-11-04 |
| CVE-2026-112605 | low | 3.3 | No | This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files. | 2026-11-04 |
| CVE-2026-112602 | low | 3.3 | No | An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensiti... | 2026-11-04 |
| CVE-2026-113909 | high | 8.0 | No | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iP... | 2026-11-04 |
| CVE-2026-112524 | high | 7.7 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, m... | 2026-11-04 |
| CVE-2026-112362 | critical | 9.1 | No | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with th... | 2026-11-04 |
| CVE-2026-112461 | high | 7.8 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and... | 2026-11-04 |