Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120930 | medium | 5.4 | No | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted... | 2026-11-04 |
| CVE-2026-121141 | medium | 5.4 | No | Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypa... | 2026-11-04 |
| CVE-2026-119477 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus... | 2026-11-04 |
| CVE-2026-118624 | medium | 5.4 | No | MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclo... | 2026-11-04 |
| CVE-2026-117553 | high | 7.5 | No | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attac... | 2026-11-04 |
| CVE-2026-116891 | medium | 6.1 | No | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i... | 2026-11-04 |
| CVE-2026-116879 | medium | 5.4 | No | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with... | 2026-11-04 |
| CVE-2026-116739 | medium | 4.3 | No | VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memor... | 2026-11-04 |
| CVE-2026-116489 | high | 7.5 | No | Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by... | 2026-11-04 |
| CVE-2026-116200 | medium | 5.9 | No | Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP... | 2026-11-04 |
| CVE-2026-116176 | high | 8.2 | No | vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by... | 2026-11-04 |
| CVE-2026-115448 | not reported | — | No | Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level,... | 2026-11-04 |
| CVE-2026-116172 | high | 7.5 | No | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers t... | 2026-11-04 |
| CVE-2026-116168 | medium | 6.2 | No | SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete s... | 2026-11-04 |
| CVE-2026-115724 | low | 2.9 | No | VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based on... | 2026-11-04 |
| CVE-2026-115507 | low | 3.5 | No | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpol... | 2026-11-04 |
| CVE-2026-115391 | medium | 5.8 | No | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementati... | 2026-11-04 |
| CVE-2026-114656 | critical | 9.3 | No | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certifi... | 2026-11-04 |
| CVE-2026-114639 | high | 8.7 | No | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Aut... | 2026-11-04 |
| CVE-2026-114635 | high | 8.7 | No | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS stat... | 2026-11-04 |