Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118538 | medium | 5.5 | No | A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0... | 2026-10-29 |
| CVE-2026-118080 | high | 8.8 | No | Contributor PHP Object Injection in Social Snap | 2026-10-29 |
| CVE-2026-118075 | high | 8.8 | No | Contributor PHP Object Injection in WP Media folders | 2026-10-29 |
| CVE-2026-118092 | medium | 4.3 | No | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrect... | 2026-10-29 |
| CVE-2026-116867 | high | 8.8 | No | Contributor PHP Object Injection in Dynamic QR Code – generator | 2026-10-29 |
| CVE-2026-117859 | medium | 5.4 | No | A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authent... | 2026-10-29 |
| CVE-2026-115580 | not reported | — | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table... | 2026-10-29 |
| CVE-2026-115567 | not reported | — | No | Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick... | 2026-10-29 |
| CVE-2026-115480 | medium | 5.3 | No | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_... | 2026-10-29 |
| CVE-2026-115751 | low | 3.7 | No | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the... | 2026-10-29 |
| CVE-2026-115729 | medium | 6.8 | No | @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToF... | 2026-10-29 |
| CVE-2026-113576 | medium | 6.3 | No | Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that c... | 2026-10-29 |
| CVE-2026-115477 | not reported | — | No | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP dep... | 2026-10-29 |
| CVE-2026-114621 | high | 8.8 | No | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and... | 2026-10-29 |
| CVE-2026-113399 | critical | 9.8 | No | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | 2026-10-29 |
| CVE-2026-108088 | high | 7.5 | No | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a mult... | 2026-10-29 |
| CVE-2026-111946 | medium | 5.3 | No | Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response b... | 2026-10-29 |
| CVE-2026-110688 | high | 7.5 | No | Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_pars... | 2026-10-29 |
| CVE-2026-110687 | high | 7.5 | No | Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts... | 2026-10-29 |
| CVE-2025-60482 | medium | 5.5 | No | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-maste... | 2026-10-29 |