Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118653 | medium | 5.3 | No | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Ec... | 2026-10-29 |
| CVE-2026-118652 | medium | 6.1 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a... | 2026-10-29 |
| CVE-2026-118650 | high | 7.5 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path d... | 2026-10-29 |
| CVE-2026-118266 | medium | 5.3 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target fo... | 2026-10-29 |
| CVE-2026-118263 | not reported | — | No | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-leng... | 2026-10-29 |
| CVE-2026-118262 | not reported | — | No | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network c... | 2026-10-29 |
| CVE-2026-114173 | medium | 5.3 | No | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthen... | 2026-10-29 |
| CVE-2026-113409 | medium | 4.8 | No | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripti... | 2026-10-29 |
| CVE-2026-113387 | high | 8.6 | No | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public... | 2026-10-29 |
| CVE-2026-117501 | not reported | — | No | HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, use... | 2026-10-29 |
| CVE-2026-117500 | not reported | — | No | HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every fi... | 2026-10-29 |
| CVE-2026-116531 | not reported | — | No | HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In ch... | 2026-10-29 |
| CVE-2026-116285 | not reported | — | No | HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In c... | 2026-10-29 |
| CVE-2026-116273 | not reported | — | No | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_par... | 2026-10-29 |
| CVE-2026-116272 | not reported | — | No | MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A par... | 2026-10-29 |
| CVE-2026-116271 | not reported | — | No | MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users r... | 2026-10-29 |
| CVE-2026-116270 | not reported | — | No | MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords. For each "=?" that does... | 2026-10-29 |
| CVE-2026-116269 | not reported | — | No | MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended file... | 2026-10-29 |
| CVE-2026-116268 | not reported | — | No | MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern u... | 2026-10-29 |
| CVE-2026-116267 | not reported | — | No | MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Ea... | 2026-10-29 |