Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109935 | medium | 5.3 | No | The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through th... | 2026-10-24 |
| CVE-2026-73602 | critical | 9.9 | No | Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitr... | 2026-10-24 |
| CVE-2026-73487 | critical | 9.8 | No | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attacke... | 2026-10-24 |
| CVE-2026-73032 | critical | 9.6 | No | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning... | 2026-10-24 |
| CVE-2026-70478 | critical | 10.0 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/... | 2026-10-24 |
| CVE-2026-70477 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatfl... | 2026-10-24 |
| CVE-2026-70470 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFr... | 2026-10-24 |
| CVE-2026-61174 | critical | 9.0 | No | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported versi... | 2026-10-24 |
| CVE-2026-99079 | critical | 9.8 | No | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XD... | 2026-10-24 |
| CVE-2026-99078 | critical | 9.8 | No | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With... | 2026-10-24 |
| CVE-2026-99064 | high | 8.1 | No | In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuf... | 2026-10-24 |
| CVE-2026-99051 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get... | 2026-10-24 |
| CVE-2026-99050 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_e... | 2026-10-24 |
| CVE-2026-99046 | high | 7.5 | No | In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set... | 2026-10-24 |
| CVE-2026-99042 | high | 8.4 | No | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6... | 2026-10-24 |
| CVE-2026-99030 | high | 7.5 | No | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When... | 2026-10-24 |
| CVE-2026-99018 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Und... | 2026-10-24 |
| CVE-2026-99017 | high | 7.0 | No | In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE err... | 2026-10-24 |
| CVE-2026-99016 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_o... | 2026-10-24 |
| CVE-2026-99014 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During... | 2026-10-24 |