Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113354 | medium | 6.5 | No | Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files t... | 2026-10-22 |
| CVE-2026-113386 | high | 7.1 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit t... | 2026-10-22 |
| CVE-2026-112940 | high | 7.1 | No | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side file... | 2026-10-22 |
| CVE-2026-112934 | medium | 6.1 | No | filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowin... | 2026-10-22 |
| CVE-2026-113349 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authentic... | 2026-10-22 |
| CVE-2026-111765 | high | 7.5 | No | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final,... | 2026-10-22 |
| CVE-2026-111761 | medium | 5.8 | No | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common... | 2026-10-22 |
| CVE-2026-112783 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-... | 2026-10-22 |
| CVE-2026-112370 | critical | 9.9 | No | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a m... | 2026-10-22 |
| CVE-2026-109444 | critical | 9.8 | No | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without co... | 2026-10-22 |
| CVE-2026-109440 | high | 8.8 | No | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or P... | 2026-10-22 |
| CVE-2026-109468 | high | 7.5 | No | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2026-10-22 |
| CVE-2026-105016 | critical | 9.8 | No | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | 2026-10-22 |
| CVE-2026-47606 | critical | 9.1 | No | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exp... | 2026-10-22 |
| CVE-2026-73373 | critical | 9.8 | No | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did... | 2026-10-22 |
| CVE-2026-6554 | high | 7.5 | No | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it... | 2026-10-22 |
| CVE-2026-55644 | not reported | — | No | Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing... | 2026-10-22 |
| CVE-2026-3161 | medium | 5.9 | No | IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly... | 2026-10-22 |
| CVE-2026-11319 | medium | 6.2 | No | TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that a... | 2026-10-22 |
| CVE-2026-112780 | high | 8.8 | No | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by... | 2026-10-22 |