Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19482 | high | 8.8 | No | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attac... | 2026-10-10 |
| CVE-2026-18740 | high | 8.8 | No | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attac... | 2026-10-10 |
| CVE-2026-16823 | high | 7.5 | No | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass... | 2026-10-10 |
| CVE-2026-107406 | not reported | — | No | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetSca... | 2026-10-10 |
| CVE-2026-107639 | high | 8.8 | No | ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows... | 2026-10-10 |
| CVE-2026-107634 | medium | 6.1 | No | Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset a... | 2026-10-10 |
| CVE-2026-105829 | medium | 6.1 | No | League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the Di... | 2026-10-10 |
| CVE-2026-105891 | medium | 4.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Co... | 2026-10-10 |
| CVE-2026-105079 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masters... | 2026-10-10 |
| CVE-2026-102489 | critical | 9.8 | Listed | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug... | 2026-10-10 |
| CVE-2026-95116 | high | 7.5 | No | An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c. | 2026-10-10 |
| CVE-2026-77214 | high | 8.2 | No | libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end w... | 2026-10-10 |
| CVE-2026-17609 | critical | 9.1 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and inc... | 2026-10-10 |
| CVE-2026-107448 | low | 3.4 | No | Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL... | 2026-10-10 |
| CVE-2026-17538 | medium | 5.4 | No | The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to,... | 2026-10-10 |
| CVE-2026-62253 | critical | 9.8 | No | Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddl... | 2026-10-10 |
| CVE-2026-46437 | medium | 4.8 | No | wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle... | 2026-10-10 |
| CVE-2026-107282 | not reported | — | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior... | 2026-10-10 |
| CVE-2026-107231 | not reported | — | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior... | 2026-10-10 |
| CVE-2026-107269 | low | 3.7 | No | Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate v... | 2026-10-10 |