Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-47302 | high | 7.5 | No | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | 2026-10-28 |
| CVE-2026-47300 | high | 8.8 | No | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | 2026-10-28 |
| CVE-2026-42020 | critical | 9.1 | No | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G... | 2026-10-28 |
| CVE-2026-42019 | critical | 9.1 | No | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G... | 2026-10-28 |
| CVE-2026-41223 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-G... | 2026-10-28 |
| CVE-2026-41222 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-... | 2026-10-28 |
| CVE-2026-40627 | critical | 9.1 | No | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202... | 2026-10-28 |
| CVE-2026-40375 | medium | 6.5 | No | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | 2026-10-28 |
| CVE-2026-40615 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X20... | 2026-10-28 |
| CVE-2026-13451 | high | 7.7 | No | A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vul... | 2026-10-28 |
| CVE-2026-17615 | high | 7.5 | No | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote fi... | 2026-10-28 |
| CVE-2026-33568 | critical | 9.1 | No | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.... | 2026-10-28 |
| CVE-2026-28763 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R... | 2026-10-28 |
| CVE-2026-117574 | critical | 9.1 | No | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request s... | 2026-10-28 |
| CVE-2026-115786 | medium | 6.5 | No | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox... | 2026-10-28 |
| CVE-2026-114357 | not reported | — | No | Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through... | 2026-10-28 |
| CVE-2026-114356 | not reported | — | No | Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Andr... | 2026-10-28 |
| CVE-2026-114355 | not reported | — | No | OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android... | 2026-10-28 |
| CVE-2026-112344 | medium | 6.8 | No | Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user... | 2026-10-28 |
| CVE-2026-112343 | high | 8.1 | No | Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permis... | 2026-10-28 |