Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87659 | critical | 9.8 | No | A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compro... | 2026-10-13 |
| CVE-2026-104626 | high | 8.8 | No | A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that i... | 2026-10-13 |
| CVE-2026-87665 | high | 7.5 | No | A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions befor... | 2026-10-13 |
| CVE-2026-87668 | medium | 6.5 | No | A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When pro... | 2026-10-13 |
| CVE-2026-104632 | high | 8.8 | No | Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun... | 2026-10-13 |
| CVE-2026-104636 | high | 7.5 | No | Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent... | 2026-10-13 |
| CVE-2026-9216 | low | 3.5 | No | An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network acc... | 2026-10-13 |
| CVE-2026-9215 | medium | 6.7 | No | A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techni... | 2026-10-13 |
| CVE-2026-90460 | not reported | — | No | An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, applicat... | 2026-10-13 |
| CVE-2026-78025 | high | 7.5 | No | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vuln... | 2026-10-13 |
| CVE-2026-78015 | medium | 5.3 | No | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An una... | 2026-10-13 |
| CVE-2026-75347 | high | 7.5 | No | EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Pac... | 2026-10-13 |
| CVE-2026-75345 | high | 7.5 | No | OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to c... | 2026-10-13 |
| CVE-2026-87669 | medium | 4.3 | No | A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authent... | 2026-10-13 |
| CVE-2026-55675 | critical | 10.0 | No | The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220... | 2026-10-13 |
| CVE-2026-42702 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflect... | 2026-10-13 |
| CVE-2026-39785 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery gra... | 2026-10-13 |
| CVE-2026-32574 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms all... | 2026-10-13 |
| CVE-2026-109959 | medium | 4.3 | No | EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted... | 2026-10-13 |
| CVE-2026-109673 | high | 7.3 | No | Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain rec... | 2026-10-13 |