Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118030 | medium | 4.2 | No | A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management serv... | 2026-10-29 |
| CVE-2026-116010 | medium | 4.3 | No | RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students out... | 2026-10-29 |
| CVE-2026-115892 | not reported | — | No | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a... | 2026-10-29 |
| CVE-2026-115885 | not reported | — | No | The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a tempor... | 2026-10-29 |
| CVE-2026-115877 | medium | 5.4 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.hea... | 2026-10-29 |
| CVE-2026-115810 | high | 7.7 | No | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privi... | 2026-10-29 |
| CVE-2026-115802 | medium | 4.3 | No | A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experimen... | 2026-10-29 |
| CVE-2026-115774 | medium | 4.9 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server r... | 2026-10-29 |
| CVE-2026-115797 | low | 3.7 | No | A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing... | 2026-10-29 |
| CVE-2026-115572 | not reported | — | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same no... | 2026-10-29 |
| CVE-2026-113143 | high | 8.8 | No | Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromi... | 2026-10-29 |
| CVE-2025-62841 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-10-29 |
| CVE-2025-62839 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-10-29 |
| CVE-2026-101897 | not reported | — | No | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.2... | 2026-10-29 |
| CVE-2026-100404 | medium | 6.5 | No | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for publi... | 2026-10-29 |
| CVE-2026-100394 | medium | 6.5 | No | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.wor... | 2026-10-29 |
| CVE-2026-104875 | high | 7.1 | No | Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve... | 2026-10-29 |
| CVE-2026-118658 | medium | 4.7 | No | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-... | 2026-10-29 |
| CVE-2026-118657 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A cli... | 2026-10-29 |
| CVE-2026-118654 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve... | 2026-10-29 |