Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-55381 | high | 7.1 | No | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to... | 2026-10-15 |
| CVE-2026-111220 | high | 7.2 | No | pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute c... | 2026-10-15 |
| CVE-2026-94520 | medium | 4.9 | No | Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network. | 2026-10-15 |
| CVE-2026-85888 | high | 7.7 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-10-15 |
| CVE-2026-67628 | medium | 4.9 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-10-15 |
| CVE-2026-67626 | medium | 6.5 | No | Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network. | 2026-10-15 |
| CVE-2026-70098 | high | 8.8 | No | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | 2026-10-15 |
| CVE-2026-102238 | critical | 9.6 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to exec... | 2026-10-15 |
| CVE-2026-102235 | high | 8.8 | No | Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. | 2026-10-15 |
| CVE-2026-102234 | high | 7.4 | No | Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over... | 2026-10-15 |
| CVE-2026-14308 | medium | 4.9 | No | Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWSer... | 2026-10-15 |
| CVE-2026-96614 | medium | 5.4 | No | "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able... | 2026-10-15 |
| CVE-2026-75559 | medium | 5.3 | No | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included i... | 2026-10-15 |
| CVE-2026-72528 | medium | 4.3 | No | "Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL,... | 2026-10-15 |
| CVE-2026-105271 | medium | 4.3 | No | "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to o... | 2026-10-15 |
| CVE-2026-103671 | medium | 4.7 | No | External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited,... | 2026-10-15 |
| CVE-2026-107153 | medium | 6.6 | No | Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physi... | 2026-10-15 |
| CVE-2026-93582 | critical | 9.4 | No | The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USE... | 2026-10-15 |
| CVE-2026-93581 | medium | 6.1 | No | User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data sub... | 2026-10-15 |
| CVE-2026-78359 | medium | 5.4 | No | OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multipl... | 2026-10-15 |