Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116197 | low | 2.6 | No | Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wild... | 2026-10-29 |
| CVE-2026-116193 | medium | 5.3 | No | Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip au... | 2026-10-29 |
| CVE-2026-116189 | high | 7.5 | No | rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes pre... | 2026-10-29 |
| CVE-2026-116181 | medium | 6.5 | No | vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by suppl... | 2026-10-29 |
| CVE-2026-116177 | high | 7.5 | No | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust... | 2026-10-29 |
| CVE-2026-116169 | medium | 5.4 | No | SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script... | 2026-10-29 |
| CVE-2026-116165 | not reported | — | No | Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets... | 2026-10-29 |
| CVE-2026-116161 | not reported | — | No | Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription... | 2026-10-29 |
| CVE-2026-116153 | low | 2.5 | No | ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory w... | 2026-10-29 |
| CVE-2026-116149 | high | 8.1 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Atta... | 2026-10-29 |
| CVE-2026-116145 | low | 3.9 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass rep... | 2026-10-29 |
| CVE-2026-116141 | medium | 5.3 | No | ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height... | 2026-10-29 |
| CVE-2026-116136 | medium | 5.9 | No | ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share... | 2026-10-29 |
| CVE-2026-116070 | medium | 6.5 | No | Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated atta... | 2026-10-29 |
| CVE-2026-116066 | medium | 6.8 | No | Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to... | 2026-10-29 |
| CVE-2026-116050 | high | 7.3 | No | A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unk... | 2026-10-29 |
| CVE-2026-116047 | medium | 4.3 | No | A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the... | 2026-10-29 |
| CVE-2026-116044 | medium | 6.3 | No | A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of... | 2026-10-29 |
| CVE-2026-108494 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz | 2026-10-29 |
| CVE-2026-107042 | high | 7.5 | No | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in a... | 2026-10-29 |