Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114115 | low | 3.7 | No | Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bou... | 2026-10-22 |
| CVE-2026-114110 | medium | 5.3 | No | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with rel... | 2026-10-22 |
| CVE-2026-114100 | medium | 5.8 | No | Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Conten... | 2026-10-22 |
| CVE-2026-114090 | high | 7.1 | No | Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all... | 2026-10-22 |
| CVE-2026-114060 | medium | 4.7 | No | SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting pa... | 2026-10-22 |
| CVE-2020-37288 | low | 3.7 | No | Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or mor... | 2026-10-22 |
| CVE-2026-102785 | not reported | — | No | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible im... | 2026-10-22 |
| CVE-2026-21812 | low | 2.2 | No | HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicat... | 2026-10-22 |
| CVE-2026-114198 | not reported | — | No | Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.... | 2026-10-22 |
| CVE-2026-114197 | not reported | — | No | Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.... | 2026-10-22 |
| CVE-2026-113868 | medium | 5.3 | No | When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malici... | 2026-10-22 |
| CVE-2026-113866 | medium | 5.9 | No | When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due t... | 2026-10-22 |
| CVE-2026-95641 | high | 7.8 | No | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu... | 2026-10-22 |
| CVE-2026-95695 | critical | 9.1 | No | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to... | 2026-10-22 |
| CVE-2026-95696 | high | 7.5 | No | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an... | 2026-10-22 |
| CVE-2026-113779 | high | 8.8 | No | The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escal... | 2026-10-22 |
| CVE-2026-113730 | medium | 5.6 | No | OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod chec... | 2026-10-22 |
| CVE-2026-98121 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313... | 2026-10-22 |
| CVE-2026-107692 | medium | 4.8 | No | The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, usin... | 2026-10-22 |
| CVE-2026-98122 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb... | 2026-10-22 |