Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116695 | not reported | — | No | Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing p... | 2026-10-28 |
| CVE-2026-112355 | high | 7.5 | No | The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers... | 2026-10-28 |
| CVE-2026-118173 | not reported | — | No | MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags.... | 2026-10-28 |
| CVE-2026-118172 | not reported | — | No | The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispat... | 2026-10-28 |
| CVE-2026-118171 | not reported | — | No | The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privi... | 2026-10-28 |
| CVE-2026-118170 | not reported | — | No | The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe... | 2026-10-28 |
| CVE-2026-116683 | not reported | — | No | CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive v... | 2026-10-28 |
| CVE-2026-118132 | not reported | — | No | NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of exte... | 2026-10-28 |
| CVE-2026-116682 | high | 8.6 | No | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/... | 2026-10-28 |
| CVE-2026-116680 | medium | 6.4 | No | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierU... | 2026-10-28 |
| CVE-2026-116677 | not reported | — | No | OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 unt... | 2026-10-28 |
| CVE-2026-116676 | high | 8.8 | No | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, A... | 2026-10-28 |
| CVE-2026-109823 | not reported | — | No | An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the re... | 2026-10-28 |
| CVE-2026-104189 | high | 7.5 | No | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions... | 2026-10-28 |
| CVE-2026-115402 | not reported | — | No | OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition i... | 2026-10-28 |
| CVE-2026-103995 | not reported | — | No | Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response co... | 2026-10-28 |
| CVE-2026-93520 | high | 7.8 | No | A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25... | 2026-10-28 |
| CVE-2026-93519 | high | 7.8 | No | A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could... | 2026-10-28 |
| CVE-2026-93518 | high | 7.8 | No | An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server bef... | 2026-10-28 |
| CVE-2026-63286 | high | 7.1 | No | Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS... | 2026-10-28 |