Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115221 | medium | 5.4 | No | A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assign... | 2026-10-26 |
| CVE-2026-110733 | medium | 5.4 | No | Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quotin... | 2026-10-26 |
| CVE-2026-110845 | not reported | — | No | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, whic... | 2026-10-26 |
| CVE-2026-110640 | critical | 9.8 | No | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted fil... | 2026-10-26 |
| CVE-2026-110635 | critical | 9.8 | No | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via exe... | 2026-10-26 |
| CVE-2026-110620 | medium | 6.8 | No | Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that... | 2026-10-26 |
| CVE-2026-110610 | medium | 5.4 | No | ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenti... | 2026-10-26 |
| CVE-2026-110605 | medium | 5.5 | No | libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with units... | 2026-10-26 |
| CVE-2026-110595 | medium | 4.3 | No | BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads befor... | 2026-10-26 |
| CVE-2026-110270 | medium | 5.5 | No | OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET s... | 2026-10-26 |
| CVE-2026-110259 | medium | 5.5 | No | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to ca... | 2026-10-26 |
| CVE-2026-109574 | medium | 5.5 | No | Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the p... | 2026-10-26 |
| CVE-2026-109571 | medium | 4.3 | No | Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to sub... | 2026-10-26 |
| CVE-2026-109566 | critical | 9.8 | No | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain su... | 2026-10-26 |
| CVE-2026-109356 | medium | 4.3 | No | LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically... | 2026-10-26 |
| CVE-2026-109351 | medium | 6.5 | No | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process b... | 2026-10-26 |
| CVE-2026-109346 | high | 8.1 | No | better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET... | 2026-10-26 |
| CVE-2026-109341 | high | 7.1 | No | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-r... | 2026-10-26 |
| CVE-2026-109336 | medium | 4.3 | No | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT p... | 2026-10-26 |
| CVE-2026-109331 | high | 7.4 | No | Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches... | 2026-10-26 |