Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-64993 | critical | 9.1 | No | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated a... | 2026-10-24 |
| CVE-2026-69264 | critical | 9.8 | No | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code temp... | 2026-10-24 |
| CVE-2026-69263 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 bl... | 2026-10-24 |
| CVE-2026-69258 | critical | 9.1 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/pr... | 2026-10-24 |
| CVE-2026-65400 | critical | 9.8 | Listed | An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, mac... | 2026-10-24 |
| CVE-2026-66384 | medium | 5.3 | Listed | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | 2026-10-24 |
| CVE-2026-89673 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_... | 2026-10-24 |
| CVE-2026-89623 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at t... | 2026-10-24 |
| CVE-2026-112863 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflecte... | 2026-10-24 |
| CVE-2026-112859 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects L... | 2026-10-24 |
| CVE-2026-112858 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a thr... | 2026-10-24 |
| CVE-2026-112856 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds:... | 2026-10-24 |
| CVE-2026-112855 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1... | 2026-10-24 |
| CVE-2026-112854 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Ho... | 2026-10-24 |
| CVE-2026-112852 | high | 8.1 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a... | 2026-10-24 |
| CVE-2026-112851 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n... | 2026-10-24 |
| CVE-2026-112850 | high | 8.1 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your D... | 2026-10-24 |
| CVE-2026-112848 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from... | 2026-10-24 |
| CVE-2026-112847 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a thr... | 2026-10-24 |
| CVE-2026-112846 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life:... | 2026-10-24 |