Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119133 | low | 2.6 | No | Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavio... | 2026-10-29 |
| CVE-2026-119129 | high | 8.1 | No | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to app... | 2026-10-29 |
| CVE-2026-119125 | low | 3.1 | No | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object u... | 2026-10-29 |
| CVE-2026-119121 | medium | 4.3 | No | Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API client... | 2026-10-29 |
| CVE-2026-15564 | high | 7.4 | No | Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to t... | 2026-10-29 |
| CVE-2026-119052 | high | 7.5 | No | llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attacke... | 2026-10-29 |
| CVE-2026-119048 | medium | 4.2 | No | JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated... | 2026-10-29 |
| CVE-2026-119027 | high | 7.5 | No | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted serve... | 2026-10-29 |
| CVE-2026-118804 | high | 7.5 | No | Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted po... | 2026-10-29 |
| CVE-2026-118755 | high | 7.2 | No | Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute s... | 2026-10-29 |
| CVE-2026-118694 | high | 7.5 | No | python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown wit... | 2026-10-29 |
| CVE-2026-118690 | critical | 9.8 | No | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log a... | 2026-10-29 |
| CVE-2026-118668 | not reported | — | No | langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authe... | 2026-10-29 |
| CVE-2026-118664 | not reported | — | No | decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to... | 2026-10-29 |
| CVE-2026-83647 | high | 7.5 | No | Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network. | 2026-10-29 |
| CVE-2026-118589 | medium | 5.3 | No | A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component... | 2026-10-29 |
| CVE-2026-118579 | critical | 9.8 | No | A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the comp... | 2026-10-29 |
| CVE-2026-118660 | high | 8.6 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src... | 2026-10-29 |
| CVE-2026-118656 | medium | 6.1 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whet... | 2026-10-29 |
| CVE-2026-83933 | medium | 5.5 | No | Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to discl... | 2026-10-29 |