Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113707 | medium | 5.4 | No | A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the... | 2026-10-28 |
| CVE-2026-113672 | critical | 9.9 | No | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-se... | 2026-10-28 |
| CVE-2026-112945 | not reported | — | No | Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware ar... | 2026-10-28 |
| CVE-2026-112941 | low | 3.3 | No | filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a succes... | 2026-10-28 |
| CVE-2026-112935 | medium | 4.7 | No | filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker fr... | 2026-10-28 |
| CVE-2026-111762 | not reported | — | No | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/r... | 2026-10-28 |
| CVE-2020-37287 | medium | 5.9 | No | Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base me... | 2026-10-28 |
| CVE-2026-63569 | medium | 6.5 | No | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp b... | 2026-10-28 |
| CVE-2014-125138 | high | 8.8 | No | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerab... | 2026-10-28 |
| CVE-2014-125137 | medium | 6.5 | No | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability... | 2026-10-28 |
| CVE-2026-102799 | not reported | — | No | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 | 2026-10-28 |
| CVE-2026-102790 | not reported | — | No | Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16 | 2026-10-28 |
| CVE-2026-104384 | not reported | — | No | Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premi... | 2026-10-28 |
| CVE-2026-104383 | not reported | — | No | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows a... | 2026-10-28 |
| CVE-2026-118374 | medium | 5.9 | No | LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sendi... | 2026-10-28 |
| CVE-2026-118373 | low | 3.7 | No | LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_al... | 2026-10-28 |
| CVE-2026-118371 | low | 3.7 | No | LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which wri... | 2026-10-28 |
| CVE-2026-103600 | high | 7.5 | No | Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 al... | 2026-10-28 |
| CVE-2026-102816 | not reported | — | No | An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on t... | 2026-10-28 |
| CVE-2026-102813 | not reported | — | No | An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthen... | 2026-10-28 |