Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76303 | medium | 5.7 | No | In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that... | 2026-10-23 |
| CVE-2026-57113 | high | 8.1 | No | PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template UR... | 2026-10-23 |
| CVE-2026-115727 | high | 8.1 | No | AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while... | 2026-10-23 |
| CVE-2026-115723 | high | 7.4 | No | Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow... | 2026-10-23 |
| CVE-2026-115390 | medium | 5.7 | No | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch pa... | 2026-10-23 |
| CVE-2026-115386 | low | 2.6 | No | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_re... | 2026-10-23 |
| CVE-2026-115382 | medium | 4.8 | No | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allow... | 2026-10-23 |
| CVE-2026-115364 | low | 2.2 | No | OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-H... | 2026-10-23 |
| CVE-2026-115356 | medium | 5.4 | No | OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service ac... | 2026-10-23 |
| CVE-2026-115333 | medium | 5.9 | No | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefi... | 2026-10-23 |
| CVE-2026-115329 | medium | 5.9 | No | Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped qu... | 2026-10-23 |
| CVE-2026-115325 | high | 8.3 | No | Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to mod... | 2026-10-23 |
| CVE-2026-115321 | medium | 4.3 | No | Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project u... | 2026-10-23 |
| CVE-2026-114663 | high | 8.4 | No | Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resol... | 2026-10-23 |
| CVE-2026-114659 | medium | 6.5 | No | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes chec... | 2026-10-23 |
| CVE-2026-114634 | medium | 4.3 | No | WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers()... | 2026-10-23 |
| CVE-2026-114607 | critical | 9.1 | No | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Lin... | 2026-10-23 |
| CVE-2026-114515 | medium | 6.5 | No | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior... | 2026-10-23 |
| CVE-2026-114492 | medium | 6.5 | No | gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary... | 2026-10-23 |
| CVE-2026-114145 | high | 7.5 | No | GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py ac... | 2026-10-23 |