Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118769 | not reported | — | No | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t bloc... | 2026-10-30 |
| CVE-2026-118767 | medium | 4.8 | No | Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const c... | 2026-10-30 |
| CVE-2026-107347 | high | 8.4 | No | HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a ma... | 2026-10-30 |
| CVE-2026-102260 | medium | 4.3 | No | HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may al... | 2026-10-30 |
| CVE-2026-118765 | not reported | — | No | Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize wit... | 2026-10-30 |
| CVE-2023-7357 | not reported | — | No | A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addres... | 2026-10-30 |
| CVE-2026-119148 | medium | 6.5 | No | Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To r... | 2026-10-30 |
| CVE-2026-119762 | high | 7.5 | No | Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerabili... | 2026-10-30 |
| CVE-2026-119714 | medium | 6.5 | No | My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execu... | 2026-10-30 |
| CVE-2026-119713 | high | 8.8 | No | Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupComman... | 2026-10-30 |
| CVE-2026-119710 | high | 7.1 | No | PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope... | 2026-10-30 |
| CVE-2026-119709 | medium | 5.8 | No | Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that pas... | 2026-10-30 |
| CVE-2026-119705 | medium | 5.3 | No | SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to... | 2026-10-30 |
| CVE-2026-119702 | medium | 6.5 | No | WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers t... | 2026-10-30 |
| CVE-2026-119701 | medium | 5.3 | No | WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails... | 2026-10-30 |
| CVE-2026-119662 | high | 8.8 | No | Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as admini... | 2026-10-30 |
| CVE-2026-119661 | medium | 4.2 | No | ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permiss... | 2026-10-30 |
| CVE-2026-119658 | medium | 4.3 | No | PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh seco... | 2026-10-30 |
| CVE-2026-119653 | medium | 4.3 | No | Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by... | 2026-10-30 |
| CVE-2026-119650 | medium | 5.4 | No | HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to... | 2026-10-30 |