Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65145 | critical | 10.0 | No | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lea... | 2026-10-27 |
| CVE-2026-65120 | high | 7.1 | No | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulne... | 2026-10-27 |
| CVE-2026-65119 | high | 8.4 | No | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusi... | 2026-10-27 |
| CVE-2026-24269 | high | 7.1 | No | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulne... | 2026-10-27 |
| CVE-2026-107590 | not reported | — | No | An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and ea... | 2026-10-27 |
| CVE-2026-117499 | low | 3.7 | No | @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that r... | 2026-10-27 |
| CVE-2026-112362 | critical | 9.1 | No | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with th... | 2026-10-27 |
| CVE-2026-107472 | not reported | — | No | An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) imp... | 2026-10-27 |
| CVE-2026-105946 | not reported | — | No | Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obt... | 2026-10-27 |
| CVE-2026-4337 | not reported | — | No | Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of... | 2026-10-27 |
| CVE-2026-117538 | medium | 4.1 | No | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is co... | 2026-10-27 |
| CVE-2026-117534 | medium | 5.4 | No | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete his... | 2026-10-27 |
| CVE-2026-116899 | medium | 6.5 | No | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categ... | 2026-10-27 |
| CVE-2026-116895 | medium | 5.4 | No | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.p... | 2026-10-27 |
| CVE-2026-117494 | not reported | — | No | Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64.... | 2026-10-27 |
| CVE-2026-117493 | not reported | — | No | Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘... | 2026-10-27 |
| CVE-2026-16307 | medium | 4.3 | No | Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not... | 2026-10-27 |
| CVE-2026-118027 | not reported | — | No | Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | 2026-10-27 |
| CVE-2026-118018 | not reported | — | No | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159. | 2026-10-27 |
| CVE-2026-92546 | high | 7.5 | No | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass.... | 2026-10-27 |