Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105407 | high | 8.8 | No | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrar... | 2026-10-15 |
| CVE-2026-103929 | high | 7.8 | No | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [set... | 2026-10-15 |
| CVE-2026-104115 | not reported | — | No | A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in... | 2026-10-15 |
| CVE-2026-101947 | not reported | — | No | ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CS... | 2026-10-15 |
| CVE-2026-103413 | high | 8.8 | No | Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernete... | 2026-10-15 |
| CVE-2026-103412 | high | 8.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name s... | 2026-10-15 |
| CVE-2026-100354 | high | 7.5 | No | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycl... | 2026-10-15 |
| CVE-2026-100350 | medium | 5.3 | No | kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for t... | 2026-10-15 |
| CVE-2026-0319 | not reported | — | No | An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user t... | 2026-10-15 |
| CVE-2026-0318 | not reported | — | No | A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables a... | 2026-10-15 |
| CVE-2026-0317 | not reported | — | No | A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to... | 2026-10-15 |
| CVE-2026-0316 | not reported | — | No | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to... | 2026-10-15 |
| CVE-2026-0314 | not reported | — | No | A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denia... | 2026-10-15 |
| CVE-2017-20283 | medium | 6.5 | No | NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of... | 2026-10-15 |
| CVE-2026-19627 | high | 8.2 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due t... | 2026-10-15 |
| CVE-2026-75061 | high | 7.5 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially... | 2026-10-15 |
| CVE-2026-75063 | medium | 5.4 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encod... | 2026-10-15 |
| CVE-2026-59318 | critical | 9.8 | No | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a too... | 2026-10-15 |
| CVE-2025-14308 | critical | 9.8 | No | An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly v... | 2026-10-15 |
| CVE-2025-14306 | critical | 9.1 | No | A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to... | 2026-10-15 |