Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87319 | medium | 6.3 | No | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versi... | 2026-10-28 |
| CVE-2026-114116 | medium | 5.3 | No | Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like for... | 2026-10-28 |
| CVE-2026-114111 | not reported | — | No | sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-spe... | 2026-10-28 |
| CVE-2026-114106 | high | 7.5 | No | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server fil... | 2026-10-28 |
| CVE-2026-114101 | medium | 4.0 | No | Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters... | 2026-10-28 |
| CVE-2026-114096 | high | 7.8 | No | Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to writ... | 2026-10-28 |
| CVE-2026-105489 | critical | 9.9 | No | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | 2026-10-28 |
| CVE-2026-113665 | low | 3.7 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST en... | 2026-10-28 |
| CVE-2026-113659 | medium | 6.1 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whos... | 2026-10-28 |
| CVE-2026-113654 | not reported | — | No | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prio... | 2026-10-28 |
| CVE-2026-113650 | medium | 5.3 | No | ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an | 2026-10-28 |
| CVE-2026-112950 | medium | 5.9 | No | Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed a... | 2026-10-28 |
| CVE-2025-63031 | medium | 5.3 | No | Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access C... | 2026-10-28 |
| CVE-2026-88812 | high | 7.8 | No | A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a c... | 2026-10-28 |
| CVE-2026-87086 | high | 7.5 | No | Tanium addressed a denial of service vulnerability in Provision. | 2026-10-28 |
| CVE-2026-87085 | medium | 6.3 | No | Tanium addressed a SQL injection vulnerability in Provision. | 2026-10-28 |
| CVE-2026-116662 | high | 7.5 | No | Tanium addressed a compression bomb vulnerability in Enforce. | 2026-10-28 |
| CVE-2026-116660 | medium | 4.3 | No | Tanium addressed an improper access controls vulnerability in Enforce. | 2026-10-28 |
| CVE-2026-116659 | medium | 4.3 | No | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | 2026-10-28 |
| CVE-2026-116658 | medium | 6.5 | No | Tanium addressed a denial of service vulnerability in Enforce. | 2026-10-28 |