Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16678 | medium | 4.5 | No | IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote au... | 2026-10-13 |
| CVE-2026-105052 | high | 7.5 | No | IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker... | 2026-10-13 |
| CVE-2026-96012 | critical | 9.9 | No | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that... | 2026-10-13 |
| CVE-2026-104364 | low | 3.3 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input val... | 2026-10-13 |
| CVE-2026-104332 | medium | 5.5 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with... | 2026-10-13 |
| CVE-2026-78404 | medium | 6.5 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility. | 2026-10-13 |
| CVE-2026-18166 | high | 7.7 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote auth... | 2026-10-13 |
| CVE-2026-105466 | medium | 6.5 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns u... | 2026-10-13 |
| CVE-2026-105465 | high | 8.8 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instan... | 2026-10-13 |
| CVE-2026-105464 | high | 8.8 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attac... | 2026-10-13 |
| CVE-2026-109229 | high | 7.5 | No | SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting... | 2026-10-13 |
| CVE-2026-108930 | low | 2.7 | No | A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_lis... | 2026-10-13 |
| CVE-2026-108926 | medium | 6.3 | No | A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebap... | 2026-10-13 |
| CVE-2026-108899 | high | 7.3 | No | A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.g... | 2026-10-13 |
| CVE-2026-109188 | medium | 4.3 | No | jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master... | 2026-10-13 |
| CVE-2026-109183 | medium | 4.3 | No | jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting st... | 2026-10-13 |
| CVE-2026-109178 | medium | 5.4 | No | jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or d... | 2026-10-13 |
| CVE-2026-109173 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject i... | 2026-10-13 |
| CVE-2026-109166 | medium | 6.5 | No | lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs... | 2026-10-13 |
| CVE-2026-108895 | critical | 9.9 | No | A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executi... | 2026-10-13 |