Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107371 | medium | 5.4 | No | When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting I... | 2026-10-15 |
| CVE-2026-107370 | medium | 5.3 | No | When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication tra... | 2026-10-15 |
| CVE-2026-107369 | medium | 6.1 | No | The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step,... | 2026-10-15 |
| CVE-2026-96299 | medium | 6.5 | No | A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could c... | 2026-10-15 |
| CVE-2026-96297 | medium | 6.5 | No | Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been rele... | 2026-10-15 |
| CVE-2026-104005 | medium | 6.5 | No | A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could c... | 2026-10-15 |
| CVE-2026-104004 | medium | 6.5 | No | MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can ca... | 2026-10-15 |
| CVE-2026-103965 | medium | 5.4 | No | An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriti... | 2026-10-15 |
| CVE-2026-107832 | low | 3.7 | No | fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names de... | 2026-10-15 |
| CVE-2026-89208 | medium | 5.3 | No | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions... | 2026-10-15 |
| CVE-2026-89206 | medium | 6.3 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side author... | 2026-10-15 |
| CVE-2026-89205 | medium | 6.3 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side author... | 2026-10-15 |
| CVE-2026-89204 | medium | 5.4 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to databas... | 2026-10-15 |
| CVE-2026-89203 | medium | 4.3 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various... | 2026-10-15 |
| CVE-2026-89201 | high | 7.5 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input... | 2026-10-15 |
| CVE-2026-89200 | medium | 6.7 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input... | 2026-10-15 |
| CVE-2026-89199 | high | 8.8 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensiti... | 2026-10-15 |
| CVE-2026-89198 | high | 8.8 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the f... | 2026-10-15 |
| CVE-2026-89196 | high | 8.8 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input... | 2026-10-15 |
| CVE-2026-78557 | high | 8.3 | No | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or... | 2026-10-15 |