Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61702 | medium | 5.3 | No | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in sched... | 2026-10-28 |
| CVE-2026-58616 | low | 3.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an autho... | 2026-10-28 |
| CVE-2026-118668 | not reported | — | No | langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authe... | 2026-10-28 |
| CVE-2026-118667 | medium | 4.3 | No | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python application... | 2026-10-28 |
| CVE-2026-55103 | high | 8.6 | No | Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub p... | 2026-10-28 |
| CVE-2026-118666 | not reported | — | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy W... | 2026-10-28 |
| CVE-2026-118665 | not reported | — | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy W... | 2026-10-28 |
| CVE-2026-118664 | not reported | — | No | decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to... | 2026-10-28 |
| CVE-2026-118663 | medium | 5.3 | No | @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time... | 2026-10-28 |
| CVE-2026-118662 | not reported | — | No | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before... | 2026-10-28 |
| CVE-2026-118661 | medium | 6.5 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContaine... | 2026-10-28 |
| CVE-2026-118660 | high | 8.6 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src... | 2026-10-28 |
| CVE-2026-118659 | high | 7.5 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-render... | 2026-10-28 |
| CVE-2026-118658 | medium | 4.7 | No | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-... | 2026-10-28 |
| CVE-2026-118657 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A cli... | 2026-10-28 |
| CVE-2026-118656 | medium | 6.1 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whet... | 2026-10-28 |
| CVE-2026-102479 | medium | 5.9 | No | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well k... | 2026-10-28 |
| CVE-2026-100208 | high | 8.1 | No | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-93636 | medium | 4.3 | No | An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attrib... | 2026-10-28 |
| CVE-2026-93638 | medium | 6.1 | No | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to e... | 2026-10-28 |