Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84314 | not reported | — | No | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authe... | 2026-10-13 |
| CVE-2026-5759 | critical | 9.8 | No | A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/dec... | 2026-10-13 |
| CVE-2026-55823 | not reported | — | No | Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around g... | 2026-10-13 |
| CVE-2026-54641 | high | 7.7 | No | OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in man... | 2026-10-13 |
| CVE-2026-109378 | medium | 4.3 | No | SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 r... | 2026-10-13 |
| CVE-2026-109374 | medium | 5.5 | No | ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to imper... | 2026-10-13 |
| CVE-2026-108928 | medium | 6.3 | No | A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the fi... | 2026-10-13 |
| CVE-2026-109340 | medium | 5.4 | No | SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph e... | 2026-10-13 |
| CVE-2026-108923 | medium | 6.3 | No | A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file... | 2026-10-13 |
| CVE-2026-108726 | medium | 4.3 | No | GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search... | 2026-10-13 |
| CVE-2026-86684 | high | 7.1 | No | The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instance... | 2026-10-13 |
| CVE-2026-89182 | medium | 5.4 | No | With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.priva... | 2026-10-13 |
| CVE-2026-100766 | medium | 4.3 | No | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140... | 2026-10-13 |
| CVE-2026-96594 | medium | 6.1 | No | The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not i... | 2026-10-13 |
| CVE-2026-97208 | medium | 4.9 | No | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabl... | 2026-10-13 |
| CVE-2026-16516 | high | 7.4 | No | wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchang... | 2026-10-13 |
| CVE-2026-81535 | critical | 9.1 | No | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwardin... | 2026-10-13 |
| CVE-2026-83540 | high | 8.8 | No | When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated... | 2026-10-13 |
| CVE-2026-87682 | high | 8.8 | No | Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS version... | 2026-10-13 |
| CVE-2026-87683 | high | 8.8 | No | Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.... | 2026-10-13 |