Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93517 | not reported | — | No | A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland befo... | 2026-10-28 |
| CVE-2026-6064 | high | 7.3 | No | Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933... | 2026-10-28 |
| CVE-2026-115522 | not reported | — | No | Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions... | 2026-10-28 |
| CVE-2026-118375 | high | 8.1 | No | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows... | 2026-10-28 |
| CVE-2026-118370 | medium | 5.9 | No | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger ou... | 2026-10-28 |
| CVE-2026-117610 | medium | 5.9 | No | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles... | 2026-10-28 |
| CVE-2015-20129 | high | 8.8 | No | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CS... | 2026-10-28 |
| CVE-2013-20009 | medium | 4.8 | No | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts v... | 2026-10-28 |
| CVE-2013-20008 | medium | 6.8 | No | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without... | 2026-10-28 |
| CVE-2013-20007 | high | 7.2 | No | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by in... | 2026-10-28 |
| CVE-2026-110879 | critical | 9.8 | No | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even... | 2026-10-28 |
| CVE-2026-116692 | critical | 9.8 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0... | 2026-10-28 |
| CVE-2026-116691 | medium | 6.5 | No | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, m... | 2026-10-28 |
| CVE-2026-116688 | high | 8.1 | No | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerab... | 2026-10-28 |
| CVE-2026-116687 | low | 3.1 | No | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup c... | 2026-10-28 |
| CVE-2026-116684 | medium | 6.8 | No | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 an... | 2026-10-28 |
| CVE-2026-16491 | medium | 6.5 | No | Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings.... | 2026-10-28 |
| CVE-2026-118131 | not reported | — | No | GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\Pro... | 2026-10-28 |
| CVE-2026-54462 | medium | 6.5 | No | Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/web... | 2026-10-28 |
| CVE-2026-108015 | not reported | — | No | Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts cer... | 2026-10-28 |