Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108498 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-mana... | 2026-10-15 |
| CVE-2026-108491 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-fo... | 2026-10-15 |
| CVE-2026-110694 | medium | 6.3 | No | A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/se... | 2026-10-15 |
| CVE-2026-110669 | medium | 6.5 | No | A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file... | 2026-10-15 |
| CVE-2026-110667 | high | 7.3 | No | A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2htm... | 2026-10-15 |
| CVE-2026-86461 | high | 8.8 | No | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5... | 2026-10-15 |
| CVE-2026-105066 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX... | 2026-10-15 |
| CVE-2026-92156 | medium | 6.5 | No | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0,... | 2026-10-15 |
| CVE-2026-16741 | critical | 9.8 | No | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP o... | 2026-10-15 |
| CVE-2026-16740 | critical | 9.8 | No | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc.... | 2026-10-15 |
| CVE-2026-110723 | high | 7.5 | No | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t... | 2026-10-15 |
| CVE-2026-19864 | not reported | — | No | Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintex... | 2026-10-15 |
| CVE-2026-19863 | not reported | — | No | An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configure... | 2026-10-15 |
| CVE-2026-18662 | not reported | — | No | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http... | 2026-10-15 |
| CVE-2026-18660 | not reported | — | No | In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would al... | 2026-10-15 |
| CVE-2026-18659 | not reported | — | No | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constrain... | 2026-10-15 |
| CVE-2026-77711 | not reported | — | No | When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required... | 2026-10-15 |
| CVE-2026-76184 | not reported | — | No | In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects... | 2026-10-15 |
| CVE-2026-76182 | not reported | — | No | In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, whe... | 2026-10-15 |
| CVE-2026-18661 | not reported | — | No | In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern ru... | 2026-10-15 |