Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113715 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg... | 2026-10-23 |
| CVE-2026-113712 | not reported | — | No | Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incide... | 2026-10-23 |
| CVE-2026-113669 | not reported | — | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host... | 2026-10-23 |
| CVE-2026-113664 | not reported | — | No | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can... | 2026-10-23 |
| CVE-2026-113658 | high | 7.5 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route write... | 2026-10-23 |
| CVE-2026-113649 | medium | 6.5 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheC... | 2026-10-23 |
| CVE-2026-113683 | medium | 6.1 | No | VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers t... | 2026-10-23 |
| CVE-2026-113678 | critical | 9.9 | No | Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to... | 2026-10-23 |
| CVE-2026-113507 | medium | 5.3 | No | A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The... | 2026-10-23 |
| CVE-2026-113648 | low | 3.1 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1... | 2026-10-23 |
| CVE-2026-113611 | medium | 4.9 | No | Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document cont... | 2026-10-23 |
| CVE-2026-113606 | high | 7.1 | No | Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' store... | 2026-10-23 |
| CVE-2026-113601 | medium | 4.3 | No | Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that al... | 2026-10-23 |
| CVE-2026-113596 | low | 3.1 | No | Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data vi... | 2026-10-23 |
| CVE-2026-112954 | medium | 5.3 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can... | 2026-10-23 |
| CVE-2026-111756 | not reported | — | No | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16... | 2026-10-23 |
| CVE-2026-112949 | medium | 4.7 | No | Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticat... | 2026-10-23 |
| CVE-2026-96303 | medium | 6.5 | No | Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over... | 2026-10-22 |
| CVE-2026-96251 | high | 8.8 | No | Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network. | 2026-10-22 |
| CVE-2026-93888 | high | 7.8 | No | IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection... | 2026-10-22 |