Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114098 | high | 7.8 | No | Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files ou... | 2026-10-27 |
| CVE-2026-114093 | medium | 4.3 | No | Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by... | 2026-10-27 |
| CVE-2026-114088 | medium | 6.5 | No | Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticat... | 2026-10-27 |
| CVE-2026-114083 | high | 8.1 | No | Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authent... | 2026-10-27 |
| CVE-2026-114078 | high | 8.1 | No | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that... | 2026-10-27 |
| CVE-2026-114073 | medium | 5.5 | No | Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deplo... | 2026-10-27 |
| CVE-2026-114068 | high | 8.3 | No | Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attac... | 2026-10-27 |
| CVE-2026-114063 | high | 7.5 | No | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows... | 2026-10-27 |
| CVE-2026-114058 | medium | 4.3 | No | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated user... | 2026-10-27 |
| CVE-2026-113743 | medium | 6.3 | No | A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the... | 2026-10-27 |
| CVE-2026-114048 | low | 3.5 | No | WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .jso... | 2026-10-27 |
| CVE-2026-114043 | medium | 6.5 | No | FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buff... | 2026-10-27 |
| CVE-2026-113737 | medium | 5.5 | No | A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This affects the function va... | 2026-10-27 |
| CVE-2026-113706 | low | 3.5 | No | A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmem... | 2026-10-27 |
| CVE-2026-113726 | high | 7.8 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources lea... | 2026-10-27 |
| CVE-2021-48019 | medium | 4.8 | No | Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE... | 2026-10-27 |
| CVE-2020-37286 | medium | 6.5 | No | Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function c... | 2026-10-27 |
| CVE-2024-54657 | not reported | — | No | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | 2026-10-27 |
| CVE-2024-54656 | not reported | — | No | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | 2026-10-27 |
| CVE-2024-54655 | not reported | — | No | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | 2026-10-27 |