Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83370 | high | 7.5 | No | Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2... | 2026-10-27 |
| CVE-2026-83366 | high | 7.4 | No | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are... | 2026-10-27 |
| CVE-2026-117541 | medium | 5.3 | No | svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting wel... | 2026-10-27 |
| CVE-2026-113732 | high | 7.8 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(... | 2026-10-27 |
| CVE-2026-113728 | high | 7.5 | No | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint... | 2026-10-27 |
| CVE-2026-113723 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable... | 2026-10-27 |
| CVE-2026-113718 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to writ... | 2026-10-27 |
| CVE-2026-113713 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an enviro... | 2026-10-27 |
| CVE-2026-109708 | critical | 9.6 | No | Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 15... | 2026-10-27 |
| CVE-2026-109707 | critical | 9.6 | No | Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbir... | 2026-10-27 |
| CVE-2026-109705 | critical | 9.6 | No | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability wa... | 2026-10-27 |
| CVE-2026-114642 | high | 8.7 | No | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed b... | 2026-10-27 |
| CVE-2026-100752 | critical | 9.8 | No | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds th... | 2026-10-27 |
| CVE-2026-116196 | medium | 5.3 | No | Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE... | 2026-10-27 |
| CVE-2026-116195 | medium | 6.1 | No | Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suff... | 2026-10-27 |
| CVE-2026-116192 | medium | 5.9 | No | rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http a... | 2026-10-27 |
| CVE-2026-116191 | high | 7.5 | No | Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served... | 2026-10-27 |
| CVE-2026-15723 | high | 8.2 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th... | 2026-10-27 |
| CVE-2026-12664 | medium | 6.8 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th... | 2026-10-27 |
| CVE-2026-102231 | high | 7.7 | No | Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 2026-10-27 |