Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114438 | medium | 4.2 | No | A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is orde... | 2026-10-28 |
| CVE-2026-89035 | high | 7.4 | No | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authe... | 2026-10-28 |
| CVE-2026-114382 | critical | 10.0 | No | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecg... | 2026-10-28 |
| CVE-2026-114379 | medium | 5.4 | No | A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packag... | 2026-10-28 |
| CVE-2026-114376 | medium | 6.3 | No | A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHand... | 2026-10-28 |
| CVE-2026-114362 | medium | 6.3 | No | A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets T... | 2026-10-28 |
| CVE-2026-114267 | high | 7.3 | No | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endp... | 2026-10-28 |
| CVE-2026-114264 | medium | 4.7 | No | A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of... | 2026-10-28 |
| CVE-2026-114143 | not reported | — | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/... | 2026-10-28 |
| CVE-2026-114139 | not reported | — | No | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for... | 2026-10-28 |
| CVE-2026-114135 | high | 8.8 | No | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWeb... | 2026-10-28 |
| CVE-2026-114130 | not reported | — | No | Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with... | 2026-10-28 |
| CVE-2026-114261 | high | 7.3 | No | A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function inde... | 2026-10-28 |
| CVE-2026-114258 | high | 7.3 | No | A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue... | 2026-10-28 |
| CVE-2026-114255 | high | 7.3 | No | A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the... | 2026-10-28 |
| CVE-2026-114126 | not reported | — | No | Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and... | 2026-10-28 |
| CVE-2026-114122 | low | 3.9 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 4... | 2026-10-28 |
| CVE-2026-113798 | medium | 5.4 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 4... | 2026-10-28 |
| CVE-2026-113794 | not reported | — | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standar... | 2026-10-28 |
| CVE-2026-111809 | critical | 9.3 | No | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache... | 2026-10-28 |