Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-33391 | medium | 5.4 | No | An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privi... | 2026-10-15 |
| CVE-2026-33389 | high | 7.5 | No | An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted con... | 2026-10-15 |
| CVE-2026-33388 | high | 7.4 | No | An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A... | 2026-10-15 |
| CVE-2026-33387 | medium | 4.6 | No | A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authe... | 2026-10-15 |
| CVE-2026-0310 | not reported | — | No | A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attack... | 2026-10-15 |
| CVE-2026-0309 | not reported | — | No | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restriction... | 2026-10-15 |
| CVE-2026-0308 | not reported | — | No | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to... | 2026-10-15 |
| CVE-2025-3277 | critical | 9.8 | No | An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer.... | 2026-10-15 |
| CVE-2026-106499 | medium | 4.9 | No | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose... | 2026-10-15 |
| CVE-2026-14905 | high | 8.2 | No | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulner... | 2026-10-15 |
| CVE-2024-50302 | medium | 5.5 | Listed | In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer i... | 2026-10-15 |
| CVE-2024-47685 | critical | 9.1 | No | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot repor... | 2026-10-15 |
| CVE-2024-3596 | critical | 9.0 | No | RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Acces... | 2026-10-15 |
| CVE-2026-97287 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets e... | 2026-10-15 |
| CVE-2026-78457 | high | 7.0 | No | Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | 2026-10-15 |
| CVE-2023-45853 | critical | 9.8 | No | MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,... | 2026-10-15 |
| CVE-2023-38408 | critical | 9.8 | No | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if... | 2026-10-15 |
| CVE-2023-36660 | critical | 9.8 | No | The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. | 2026-10-15 |
| CVE-2026-105846 | medium | 6.1 | No | Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0... | 2026-10-15 |
| CVE-2026-105847 | medium | 6.5 | No | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-... | 2026-10-15 |