Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107729 | medium | 5.5 | No | SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a si... | 2026-10-09 |
| CVE-2026-107724 | high | 7.4 | No | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMA... | 2026-10-09 |
| CVE-2026-107721 | medium | 5.9 | No | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance beca... | 2026-10-09 |
| CVE-2026-107719 | medium | 4.2 | No | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previ... | 2026-10-09 |
| CVE-2026-107716 | not reported | — | No | Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbo... | 2026-10-09 |
| CVE-2026-107396 | medium | 5.4 | No | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who... | 2026-10-09 |
| CVE-2026-107394 | medium | 6.8 | No | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previo... | 2026-10-09 |
| CVE-2026-107386 | not reported | — | No | amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed... | 2026-10-09 |
| CVE-2026-107380 | medium | 5.4 | No | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expa... | 2026-10-09 |
| CVE-2026-107375 | high | 8.8 | No | JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0... | 2026-10-09 |
| CVE-2026-107299 | medium | 5.9 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack b... | 2026-10-09 |
| CVE-2026-106601 | medium | 5.4 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.T... | 2026-10-09 |
| CVE-2026-105318 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newslette... | 2026-10-09 |
| CVE-2026-105436 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child:... | 2026-10-09 |
| CVE-2015-3306 | critical | 10.0 | Listed | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | 2026-10-09 |
| CVE-2026-83447 | high | 8.1 | No | Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that a... | 2026-10-09 |
| CVE-2026-83448 | high | 8.1 | No | Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that a... | 2026-10-09 |
| CVE-2026-106384 | medium | 6.5 | No | Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer pr... | 2026-10-09 |
| CVE-2026-106386 | medium | 6.5 | No | Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a... | 2026-10-09 |
| CVE-2026-106403 | high | 8.1 | No | Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer... | 2026-10-09 |