Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-24715 | not reported | — | No | An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote atta... | 2026-10-15 |
| CVE-2026-22896 | not reported | — | No | A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator... | 2026-10-15 |
| CVE-2026-21139 | not reported | — | No | Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the co... | 2026-10-15 |
| CVE-2026-21138 | not reported | — | No | Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applic... | 2026-10-15 |
| CVE-2026-21136 | not reported | — | No | Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. | 2026-10-15 |
| CVE-2026-21132 | not reported | — | No | Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interactio... | 2026-10-15 |
| CVE-2026-19577 | high | 7.1 | No | net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without fi... | 2026-10-15 |
| CVE-2026-18418 | low | 3.4 | No | The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame... | 2026-10-15 |
| CVE-2026-110850 | not reported | — | No | n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared wo... | 2026-10-15 |
| CVE-2026-110840 | not reported | — | No | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes... | 2026-10-15 |
| CVE-2026-110767 | high | 7.5 | No | Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated at... | 2026-10-15 |
| CVE-2026-107761 | not reported | — | No | Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of... | 2026-10-15 |
| CVE-2026-106583 | high | 7.8 | No | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | 2026-10-15 |
| CVE-2026-106585 | medium | 6.5 | No | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly c... | 2026-10-15 |
| CVE-2026-106150 | medium | 5.4 | No | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip... | 2026-10-15 |
| CVE-2026-106139 | medium | 5.4 | No | In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip render... | 2026-10-15 |
| CVE-2026-106138 | medium | 5.4 | No | In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders th... | 2026-10-15 |
| CVE-2026-105274 | not reported | — | No | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a... | 2026-10-15 |
| CVE-2026-105409 | high | 8.7 | No | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec... | 2026-10-15 |
| CVE-2026-105408 | high | 8.7 | No | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec... | 2026-10-15 |