Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119116 | high | 7.8 | No | A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-... | 2026-10-30 |
| CVE-2026-116693 | not reported | — | No | dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP ca... | 2026-10-30 |
| CVE-2026-115569 | low | 3.3 | No | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest proj... | 2026-10-30 |
| CVE-2026-115479 | medium | 5.3 | No | baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a... | 2026-10-30 |
| CVE-2026-115419 | high | 8.1 | No | The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 doe... | 2026-10-30 |
| CVE-2026-114655 | medium | 5.9 | No | libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS pro... | 2026-10-30 |
| CVE-2026-114654 | medium | 6.5 | No | A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied th... | 2026-10-30 |
| CVE-2026-114653 | medium | 6.5 | No | A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position tha... | 2026-10-30 |
| CVE-2026-114652 | medium | 6.5 | No | A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-sup... | 2026-10-30 |
| CVE-2026-114572 | medium | 5.4 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This is... | 2026-10-30 |
| CVE-2026-114555 | low | 3.5 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. T... | 2026-10-30 |
| CVE-2026-114622 | high | 7.2 | No | baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin... | 2026-10-30 |
| CVE-2026-114616 | critical | 9.1 | No | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing an... | 2026-10-30 |
| CVE-2026-114651 | medium | 4.0 | No | A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed... | 2026-10-30 |
| CVE-2026-114606 | not reported | — | No | draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure... | 2026-10-30 |
| CVE-2026-114510 | high | 7.1 | No | Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, an... | 2026-10-30 |
| CVE-2026-114487 | medium | 4.3 | No | Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlie... | 2026-10-30 |
| CVE-2026-114136 | high | 7.5 | No | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the cl... | 2026-10-30 |
| CVE-2026-114123 | high | 7.5 | No | D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to versio... | 2026-10-30 |
| CVE-2026-109763 | medium | 5.4 | No | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thund... | 2026-10-30 |