Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-74946 | high | 8.8 | No | Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox... | 2026-10-28 |
| CVE-2026-58255 | high | 8.8 | No | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped AP... | 2026-10-28 |
| CVE-2026-57202 | high | 8.1 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-28 |
| CVE-2026-57190 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-28 |
| CVE-2026-57189 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.... | 2026-10-28 |
| CVE-2026-57186 | high | 7.5 | No | Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certi... | 2026-10-28 |
| CVE-2026-50571 | medium | 5.7 | No | WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification prot... | 2026-10-28 |
| CVE-2026-48380 | medium | 5.5 | No | Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul... | 2026-10-28 |
| CVE-2026-118376 | medium | 5.3 | No | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 address... | 2026-10-28 |
| CVE-2026-118372 | low | 3.7 | No | LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF seq... | 2026-10-28 |
| CVE-2026-118275 | medium | 5.3 | No | A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_c... | 2026-10-28 |
| CVE-2026-118272 | medium | 4.3 | No | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file ren... | 2026-10-28 |
| CVE-2026-118128 | medium | 6.5 | No | A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/se... | 2026-10-28 |
| CVE-2026-117609 | high | 7.1 | No | rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-... | 2026-10-28 |
| CVE-2026-117605 | medium | 4.3 | No | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellPro... | 2026-10-28 |
| CVE-2026-117601 | high | 7.5 | No | Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to r... | 2026-10-28 |
| CVE-2026-117568 | high | 7.0 | No | mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted vid... | 2026-10-28 |
| CVE-2026-117564 | critical | 9.8 | No | nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens... | 2026-10-28 |
| CVE-2026-117560 | high | 7.8 | No | ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell c... | 2026-10-28 |
| CVE-2026-117556 | medium | 4.3 | No | zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header leng... | 2026-10-28 |