Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111678 | low | 3.3 | No | Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts a... | 2026-10-23 |
| CVE-2026-111668 | medium | 5.4 | No | AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged... | 2026-10-23 |
| CVE-2026-110744 | high | 7.2 | No | A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) p... | 2026-10-23 |
| CVE-2026-104068 | high | 7.2 | No | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated Wor... | 2026-10-23 |
| CVE-2026-100886 | critical | 10.0 | No | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown funct... | 2026-10-23 |
| CVE-2021-48018 | high | 7.4 | No | Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variabl... | 2026-10-23 |
| CVE-2026-104252 | critical | 9.8 | No | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletse... | 2026-10-23 |
| CVE-2026-106461 | medium | 4.3 | No | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected... | 2026-10-23 |
| CVE-2026-106486 | critical | 9.9 | No | Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-clou... | 2026-10-23 |
| CVE-2026-91651 | high | 8.5 | No | Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploi... | 2026-10-23 |
| CVE-2026-93682 | medium | 5.8 | No | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one... | 2026-10-23 |
| CVE-2025-14181 | medium | 6.5 | No | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and... | 2026-10-23 |
| CVE-2026-91637 | critical | 9.9 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabilit... | 2026-10-23 |
| CVE-2025-1218 | medium | 5.9 | No | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A mal... | 2026-10-23 |
| CVE-2026-17545 | high | 7.5 | No | On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CON... | 2026-10-23 |
| CVE-2026-94263 | medium | 4.8 | No | The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently... | 2026-10-23 |
| CVE-2026-111965 | medium | 4.3 | No | The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowi... | 2026-10-23 |
| CVE-2026-94268 | high | 8.1 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 d... | 2026-10-23 |
| CVE-2026-94267 | critical | 9.0 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 d... | 2026-10-23 |
| CVE-2026-94264 | medium | 6.8 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 d... | 2026-10-23 |