Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103007 | high | 7.2 | No | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is... | 2026-10-09 |
| CVE-2026-103008 | medium | 6.5 | No | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to co... | 2026-10-09 |
| CVE-2026-103009 | high | 7.1 | No | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross... | 2026-10-09 |
| CVE-2026-104048 | high | 8.1 | No | A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripp... | 2026-10-09 |
| CVE-2026-93860 | not reported | — | No | In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directl... | 2026-10-09 |
| CVE-2026-39717 | medium | 4.3 | No | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-09 |
| CVE-2026-107778 | medium | 6.5 | No | MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos... | 2026-10-09 |
| CVE-2026-107700 | critical | 9.8 | No | dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying craft... | 2026-10-09 |
| CVE-2026-107318 | high | 7.4 | No | @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the... | 2026-10-09 |
| CVE-2026-107395 | medium | 4.3 | No | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authent... | 2026-10-09 |
| CVE-2026-107385 | high | 7.4 | No | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7,... | 2026-10-09 |
| CVE-2026-107379 | medium | 6.5 | No | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cl... | 2026-10-09 |
| CVE-2026-102368 | not reported | — | No | Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physic... | 2026-10-09 |
| CVE-2026-104076 | critical | 9.1 | No | TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows rem... | 2026-10-09 |
| CVE-2026-107303 | high | 7.6 | No | JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to... | 2026-10-09 |
| CVE-2026-107298 | medium | 5.3 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth... | 2026-10-09 |
| CVE-2026-39725 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829. | 2026-10-09 |
| CVE-2025-55100 | critical | 9.1 | No | In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class... | 2026-10-09 |
| CVE-2025-34516 | critical | 9.8 | No | Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated att... | 2026-10-09 |
| CVE-2025-34515 | critical | 9.8 | No | Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh tha... | 2026-10-09 |