Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105420 | not reported | — | No | Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the add... | 2026-10-28 |
| CVE-2026-55369 | medium | 6.5 | No | Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the... | 2026-10-28 |
| CVE-2026-115904 | critical | 9.6 | No | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-control... | 2026-10-28 |
| CVE-2026-118485 | high | 8.1 | No | Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been pa... | 2026-10-28 |
| CVE-2026-118477 | critical | 9.8 | No | The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command In... | 2026-10-28 |
| CVE-2026-114278 | critical | 9.8 | No | The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /... | 2026-10-28 |
| CVE-2026-101274 | not reported | — | No | When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the... | 2026-10-28 |
| CVE-2026-101273 | not reported | — | No | Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was no... | 2026-10-28 |
| CVE-2026-101272 | not reported | — | No | The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session... | 2026-10-28 |
| CVE-2026-118435 | medium | 5.4 | No | Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation. | 2026-10-28 |
| CVE-2026-118377 | high | 7.5 | No | mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to for... | 2026-10-28 |
| CVE-2026-117608 | medium | 6.1 | No | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table... | 2026-10-28 |
| CVE-2026-117607 | high | 7.2 | No | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission t... | 2026-10-28 |
| CVE-2026-110747 | high | 7.5 | No | ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks... | 2026-10-28 |
| CVE-2026-104895 | high | 7.5 | No | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] b... | 2026-10-28 |
| CVE-2026-104016 | high | 7.5 | No | ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) | 2026-10-28 |
| CVE-2026-58496 | medium | 4.3 | No | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` f... | 2026-10-28 |
| CVE-2026-22063 | not reported | — | No | The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certif... | 2026-10-28 |
| CVE-2026-97045 | not reported | — | No | In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found... | 2026-10-28 |
| CVE-2026-78661 | not reported | — | No | When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data +... | 2026-10-28 |