Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51882 | critical | 9.1 | No | The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write fi... | 2026-10-07 |
| CVE-2026-46434 | high | 7.1 | No | wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate... | 2026-10-07 |
| CVE-2026-107180 | not reported | — | No | On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication s... | 2026-10-07 |
| CVE-2026-107175 | not reported | — | No | MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distr... | 2026-10-07 |
| CVE-2026-107168 | medium | 6.2 | No | A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text pars... | 2026-10-07 |
| CVE-2026-106588 | low | 3.1 | No | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpect... | 2026-10-07 |
| CVE-2026-106447 | not reported | — | No | StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes ne... | 2026-10-07 |
| CVE-2026-106442 | high | 7.8 | No | Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blackli... | 2026-10-07 |
| CVE-2026-105139 | medium | 4.3 | No | Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach... | 2026-10-07 |
| CVE-2026-104945 | not reported | — | No | TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can... | 2026-10-07 |
| CVE-2026-104073 | high | 7.6 | No | NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can ad... | 2026-10-07 |
| CVE-2026-103435 | not reported | — | No | Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the pat... | 2026-10-07 |
| CVE-2026-102258 | medium | 6.1 | No | Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) wh... | 2026-10-07 |
| CVE-2026-58834 | medium | 5.5 | No | In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input valida... | 2026-10-07 |
| CVE-2026-55270 | high | 7.8 | No | In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation o... | 2026-10-07 |
| CVE-2026-58880 | high | 7.0 | No | In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to loca... | 2026-10-07 |
| CVE-2026-58865 | high | 7.5 | No | In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to... | 2026-10-07 |
| CVE-2026-58859 | high | 7.8 | No | In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege wit... | 2026-10-07 |
| CVE-2026-58856 | low | 3.3 | No | In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. Th... | 2026-10-07 |
| CVE-2026-58854 | high | 7.8 | No | In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no... | 2026-10-07 |