Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106568 | medium | 5.3 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XM... | 2026-10-22 |
| CVE-2026-95635 | high | 7.8 | No | Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current use... | 2026-10-22 |
| CVE-2026-95636 | high | 7.8 | No | Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the contex... | 2026-10-22 |
| CVE-2026-95637 | high | 7.8 | No | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu... | 2026-10-22 |
| CVE-2026-95638 | high | 7.8 | No | Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of... | 2026-10-22 |
| CVE-2026-95639 | high | 8.6 | No | Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of th... | 2026-10-22 |
| CVE-2026-95640 | medium | 5.5 | No | Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker... | 2026-10-22 |
| CVE-2026-53986 | medium | 5.3 | No | Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability th... | 2026-10-22 |
| CVE-2026-114407 | medium | 6.1 | No | e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTM... | 2026-10-22 |
| CVE-2026-114391 | high | 7.1 | No | ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-ba... | 2026-10-22 |
| CVE-2026-114390 | medium | 5.3 | No | Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/in... | 2026-10-22 |
| CVE-2026-114389 | medium | 4.3 | No | Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows... | 2026-10-22 |
| CVE-2026-114107 | high | 8.8 | No | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell... | 2026-10-22 |
| CVE-2016-20102 | medium | 6.1 | No | JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by s... | 2026-10-22 |
| CVE-2015-20124 | high | 7.5 | No | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to... | 2026-10-22 |
| CVE-2014-125131 | medium | 6.1 | No | DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supply... | 2026-10-22 |
| CVE-2026-114493 | high | 8.6 | No | LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initi... | 2026-10-22 |
| CVE-2026-114404 | medium | 6.1 | No | PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentati... | 2026-10-22 |
| CVE-2026-114386 | medium | 4.8 | No | Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMod... | 2026-10-22 |
| CVE-2026-114120 | medium | 5.4 | No | SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any po... | 2026-10-22 |