Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110646 | high | 8.1 | No | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands b... | 2026-10-20 |
| CVE-2026-110641 | high | 8.8 | No | @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supp... | 2026-10-20 |
| CVE-2026-110636 | critical | 9.8 | No | pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shel... | 2026-10-20 |
| CVE-2026-110631 | critical | 9.8 | No | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect... | 2026-10-20 |
| CVE-2026-110626 | medium | 6.1 | No | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencod... | 2026-10-20 |
| CVE-2026-110621 | high | 8.8 | No | Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to... | 2026-10-20 |
| CVE-2026-110616 | high | 8.1 | No | NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* managem... | 2026-10-20 |
| CVE-2026-110611 | medium | 5.9 | No | REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied cha... | 2026-10-20 |
| CVE-2026-102756 | not reported | — | No | DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart... | 2026-10-20 |
| CVE-2026-109527 | high | 7.5 | No | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29... | 2026-10-20 |
| CVE-2026-102695 | high | 8.2 | No | OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler a... | 2026-10-20 |
| CVE-2026-101896 | not reported | — | No | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to... | 2026-10-20 |
| CVE-2026-110606 | low | 3.3 | No | LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFil... | 2026-10-20 |
| CVE-2026-103043 | high | 7.5 | No | anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic b... | 2026-10-20 |
| CVE-2026-100406 | not reported | — | No | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.... | 2026-10-20 |
| CVE-2016-15060 | high | 8.3 | No | A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manip... | 2026-10-20 |
| CVE-2026-84506 | high | 7.8 | No | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS... | 2026-10-20 |
| CVE-2026-110601 | medium | 6.3 | No | libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, wh... | 2026-10-20 |
| CVE-2026-110596 | medium | 5.5 | No | quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang... | 2026-10-20 |
| CVE-2026-110591 | medium | 5.5 | No | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust me... | 2026-10-20 |