Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-57144 | high | 8.8 | No | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and... | 2026-10-29 |
| CVE-2026-57116 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains... | 2026-10-29 |
| CVE-2026-56840 | high | 8.8 | No | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool appro... | 2026-10-29 |
| CVE-2026-48379 | high | 7.8 | No | Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex... | 2026-10-29 |
| CVE-2026-48360 | critical | 9.6 | No | Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code... | 2026-10-29 |
| CVE-2026-55422 | medium | 4.6 | No | conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components rende... | 2026-10-29 |
| CVE-2026-56835 | high | 8.3 | No | PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_... | 2026-10-29 |
| CVE-2026-54631 | medium | 6.3 | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Par... | 2026-10-29 |
| CVE-2026-46300 | high | 7.8 | Listed | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coa... | 2026-10-29 |
| CVE-2026-47486 | high | 7.8 | No | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this v... | 2026-10-29 |
| CVE-2026-42949 | medium | 5.6 | No | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r... | 2026-10-29 |
| CVE-2026-42922 | critical | 9.8 | No | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request... | 2026-10-29 |
| CVE-2026-40063 | medium | 5.3 | No | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially craft... | 2026-10-29 |
| CVE-2026-3583 | low | 3.1 | No | When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the... | 2026-10-29 |
| CVE-2026-41709 | low | 2.7 | Listed | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations... | 2026-10-29 |
| CVE-2026-118426 | not reported | — | No | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search... | 2026-10-29 |
| CVE-2026-16889 | not reported | — | No | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type o... | 2026-10-29 |
| CVE-2026-11854 | medium | 6.1 | No | The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitizatio... | 2026-10-29 |
| CVE-2026-118359 | high | 8.8 | No | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the s... | 2026-10-29 |
| CVE-2026-2270 | medium | 5.9 | No | A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and... | 2026-10-29 |