Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-62839 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-10-29 |
| CVE-2026-101897 | not reported | — | No | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.2... | 2026-10-29 |
| CVE-2026-100404 | medium | 6.5 | No | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for publi... | 2026-10-29 |
| CVE-2026-100394 | medium | 6.5 | No | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.wor... | 2026-10-29 |
| CVE-2026-104875 | high | 7.1 | No | Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve... | 2026-10-29 |
| CVE-2026-118658 | medium | 4.7 | No | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-... | 2026-10-29 |
| CVE-2026-118657 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A cli... | 2026-10-29 |
| CVE-2026-118654 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve... | 2026-10-29 |
| CVE-2026-118653 | medium | 5.3 | No | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Ec... | 2026-10-29 |
| CVE-2026-118652 | medium | 6.1 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a... | 2026-10-29 |
| CVE-2026-118650 | high | 7.5 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path d... | 2026-10-29 |
| CVE-2026-118266 | medium | 5.3 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target fo... | 2026-10-29 |
| CVE-2026-118264 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade... | 2026-10-29 |
| CVE-2026-118263 | not reported | — | No | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-leng... | 2026-10-29 |
| CVE-2026-118262 | not reported | — | No | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network c... | 2026-10-29 |
| CVE-2026-118260 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before h... | 2026-10-29 |
| CVE-2026-114173 | medium | 5.3 | No | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthen... | 2026-10-29 |
| CVE-2026-113409 | medium | 4.8 | No | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripti... | 2026-10-29 |
| CVE-2026-113387 | high | 8.6 | No | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public... | 2026-10-29 |
| CVE-2026-117501 | not reported | — | No | HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, use... | 2026-10-29 |