Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102137 | medium | 4.1 | No | An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dang... | 2026-10-13 |
| CVE-2026-102138 | low | 3.3 | No | An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the se... | 2026-10-13 |
| CVE-2026-102140 | medium | 4.9 | No | An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the impo... | 2026-10-13 |
| CVE-2026-102143 | high | 7.5 | No | An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an adminis... | 2026-10-13 |
| CVE-2026-102145 | medium | 6.6 | No | An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant... | 2026-10-13 |
| CVE-2026-102146 | medium | 6.5 | No | An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controll... | 2026-10-13 |
| CVE-2025-58053 | critical | 9.8 | No | Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account... | 2026-10-13 |
| CVE-2025-63388 | critical | 9.1 | No | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. Th... | 2026-10-13 |
| CVE-2025-63386 | critical | 9.1 | No | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint... | 2026-10-13 |
| CVE-2025-68118 | critical | 9.1 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate ha... | 2026-10-13 |
| CVE-2025-68114 | critical | 9.8 | No | Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs... | 2026-10-13 |
| CVE-2025-67493 | critical | 9.0 | No | Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and gettin... | 2026-10-13 |
| CVE-2025-66647 | critical | 9.8 | No | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em... | 2026-10-13 |
| CVE-2025-53619 | critical | 9.1 | No | An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DI... | 2026-10-13 |
| CVE-2025-53618 | critical | 9.1 | No | An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DI... | 2026-10-13 |
| CVE-2025-48429 | critical | 9.1 | No | An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICO... | 2026-10-13 |
| CVE-2025-68613 | high | 8.8 | Listed | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a crit... | 2026-10-13 |
| CVE-2025-68668 | critical | 9.9 | No | n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python... | 2026-10-13 |
| CVE-2025-68929 | critical | 9.0 | No | Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions cou... | 2026-10-13 |
| CVE-2025-68952 | critical | 9.8 | No | Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. Thi... | 2026-10-13 |