Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88941 | medium | 5.2 | No | Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentiall... | 2026-10-29 |
| CVE-2026-118905 | high | 7.0 | No | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `n... | 2026-10-29 |
| CVE-2026-118426 | not reported | — | No | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search... | 2026-10-29 |
| CVE-2026-118754 | medium | 5.3 | No | Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthentica... | 2026-10-29 |
| CVE-2026-118669 | not reported | — | No | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner... | 2026-10-29 |
| CVE-2026-118662 | not reported | — | No | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before... | 2026-10-29 |
| CVE-2026-118633 | high | 8.1 | No | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after... | 2026-10-29 |
| CVE-2026-118259 | medium | 5.3 | No | opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by t... | 2026-10-29 |
| CVE-2026-116795 | high | 7.5 | No | RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBE... | 2026-10-29 |
| CVE-2026-67187 | high | 7.1 | No | Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attac... | 2026-10-29 |
| CVE-2026-116778 | high | 8.8 | No | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated AP... | 2026-10-29 |
| CVE-2026-112357 | high | 7.8 | No | GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vu... | 2026-10-29 |
| CVE-2026-112356 | medium | 6.1 | No | GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a... | 2026-10-29 |
| CVE-2026-83831 | high | 8.8 | No | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-61572 | high | 8.6 | No | AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts c... | 2026-10-29 |
| CVE-2026-61569 | high | 7.5 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` paramet... | 2026-10-29 |
| CVE-2026-119144 | high | 8.8 | No | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled mes... | 2026-10-29 |
| CVE-2026-119143 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host p... | 2026-10-29 |
| CVE-2026-23705 | high | 7.2 | No | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For... | 2026-10-29 |
| CVE-2026-119140 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic... | 2026-10-29 |