Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107705 | medium | 6.5 | No | Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the pass... | 2026-10-14 |
| CVE-2026-107701 | high | 8.2 | No | dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafte... | 2026-10-14 |
| CVE-2026-105442 | high | 7.5 | No | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow... | 2026-10-14 |
| CVE-2026-103850 | medium | 5.5 | No | Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could... | 2026-10-14 |
| CVE-2026-102514 | not reported | — | No | Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11... | 2026-10-14 |
| CVE-2022-32221 | critical | 9.8 | No | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when th... | 2026-10-14 |
| CVE-2022-32207 | critical | 9.8 | No | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a ren... | 2026-10-14 |
| CVE-2022-28321 | critical | 9.8 | No | The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't... | 2026-10-14 |
| CVE-2022-29155 | critical | 9.8 | No | In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, vi... | 2026-10-14 |
| CVE-2022-25315 | critical | 9.8 | No | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 2026-10-14 |
| CVE-2022-25236 | critical | 9.8 | No | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | 2026-10-14 |
| CVE-2025-62718 | critical | 9.9 | No | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname norma... | 2026-10-14 |
| CVE-2026-88190 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-88195 | medium | 6.5 | No | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-88201 | medium | 6.5 | No | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-97009 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 2026-10-14 |
| CVE-2026-97014 | medium | 5.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 2026-10-14 |
| CVE-2026-92910 | high | 7.2 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could lev... | 2026-10-14 |
| CVE-2026-94216 | medium | 4.3 | No | A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of... | 2026-10-14 |
| CVE-2026-94214 | medium | 4.3 | No | A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler.... | 2026-10-14 |