Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65327 | high | 8.4 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-10-28 |
| CVE-2026-116891 | medium | 6.1 | No | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i... | 2026-10-28 |
| CVE-2026-116889 | medium | 6.1 | No | SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to in... | 2026-10-28 |
| CVE-2026-96521 | high | 7.8 | No | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu... | 2026-10-28 |
| CVE-2026-116875 | medium | 6.1 | No | SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator pa... | 2026-10-28 |
| CVE-2026-86929 | high | 8.8 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2,... | 2026-10-28 |
| CVE-2026-116874 | medium | 6.1 | No | SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i... | 2026-10-28 |
| CVE-2026-95664 | medium | 5.4 | No | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apac... | 2026-10-28 |
| CVE-2026-59177 | high | 8.8 | No | ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's tru... | 2026-10-28 |
| CVE-2026-59176 | high | 7.8 | No | Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-se... | 2026-10-28 |
| CVE-2026-52729 | high | 7.1 | No | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, mi... | 2026-10-28 |
| CVE-2026-50541 | medium | 6.5 | No | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, mi... | 2026-10-28 |
| CVE-2026-116078 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthentic... | 2026-10-28 |
| CVE-2026-105420 | not reported | — | No | Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the add... | 2026-10-28 |
| CVE-2026-55369 | medium | 6.5 | No | Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the... | 2026-10-28 |
| CVE-2026-115904 | critical | 9.6 | No | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-control... | 2026-10-28 |
| CVE-2026-118485 | high | 8.1 | No | Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been pa... | 2026-10-28 |
| CVE-2026-118477 | critical | 9.8 | No | The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command In... | 2026-10-28 |
| CVE-2026-114278 | critical | 9.8 | No | The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /... | 2026-10-28 |
| CVE-2026-101274 | not reported | — | No | When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the... | 2026-10-28 |