Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114081 | high | 7.7 | No | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into g... | 2026-10-28 |
| CVE-2026-114079 | medium | 5.4 | No | Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel... | 2026-10-28 |
| CVE-2026-114076 | medium | 5.4 | No | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp ser... | 2026-10-28 |
| CVE-2026-114074 | medium | 5.4 | No | Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook S... | 2026-10-28 |
| CVE-2026-114071 | low | 3.1 | No | Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another membe... | 2026-10-28 |
| CVE-2026-114069 | high | 8.1 | No | Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which re... | 2026-10-28 |
| CVE-2026-114066 | high | 8.1 | No | Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block ru... | 2026-10-28 |
| CVE-2026-114064 | medium | 5.5 | No | Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to p... | 2026-10-28 |
| CVE-2026-114061 | medium | 4.7 | No | SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header val... | 2026-10-28 |
| CVE-2026-114059 | high | 7.5 | No | ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role hold... | 2026-10-28 |
| CVE-2026-114056 | medium | 4.3 | No | ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweig... | 2026-10-28 |
| CVE-2026-114054 | medium | 6.5 | No | vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying cal... | 2026-10-28 |
| CVE-2026-114051 | high | 7.5 | No | vLLM before 0.31.0 skips the min_tokens | 2026-10-28 |
| CVE-2026-114049 | low | 3.7 | No | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outp... | 2026-10-28 |
| CVE-2026-114046 | medium | 6.5 | No | FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SC... | 2026-10-28 |
| CVE-2026-114044 | medium | 5.3 | No | FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyon... | 2026-10-28 |
| CVE-2026-114041 | medium | 6.5 | No | FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-c... | 2026-10-28 |
| CVE-2026-113736 | critical | 9.8 | No | A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defno... | 2026-10-28 |
| CVE-2026-113731 | low | 3.3 | No | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.... | 2026-10-28 |
| CVE-2026-113705 | medium | 5.3 | No | A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error... | 2026-10-28 |