Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117556 | medium | 4.3 | No | zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header leng... | 2026-10-28 |
| CVE-2026-117515 | high | 7.3 | No | A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown f... | 2026-10-28 |
| CVE-2026-117512 | high | 7.3 | No | A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Perform... | 2026-10-28 |
| CVE-2026-117509 | medium | 6.3 | No | A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/pers... | 2026-10-28 |
| CVE-2026-70275 | critical | 9.8 | No | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-117505 | medium | 4.3 | No | A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the compon... | 2026-10-28 |
| CVE-2026-116774 | medium | 4.3 | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open par... | 2026-10-28 |
| CVE-2026-116694 | not reported | — | No | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propaga... | 2026-10-28 |
| CVE-2026-116690 | high | 7.5 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, t... | 2026-10-28 |
| CVE-2026-116686 | medium | 6.5 | No | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 an... | 2026-10-28 |
| CVE-2026-116679 | medium | 5.4 | No | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mo... | 2026-10-28 |
| CVE-2026-116675 | not reported | — | No | TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted thr... | 2026-10-28 |
| CVE-2026-116673 | low | 3.3 | No | systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses th... | 2026-10-28 |
| CVE-2026-114403 | high | 8.1 | No | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PH... | 2026-10-28 |
| CVE-2026-114388 | medium | 5.3 | No | Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController th... | 2026-10-28 |
| CVE-2026-114256 | high | 7.3 | No | A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the funct... | 2026-10-28 |
| CVE-2026-114253 | medium | 6.3 | No | A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element... | 2026-10-28 |
| CVE-2026-114250 | medium | 6.3 | No | A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unk... | 2026-10-28 |
| CVE-2026-114243 | high | 7.3 | No | A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d740... | 2026-10-28 |
| CVE-2026-114119 | critical | 9.8 | No | Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all... | 2026-10-28 |