Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-11140 | critical | 9.8 | No | A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com... | 2026-10-09 |
| CVE-2025-11139 | critical | 9.8 | No | A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.s... | 2026-10-09 |
| CVE-2025-11118 | critical | 9.8 | No | A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.p... | 2026-10-09 |
| CVE-2025-11116 | critical | 9.8 | No | A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipul... | 2026-10-09 |
| CVE-2025-11115 | critical | 9.8 | No | A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the fi... | 2026-10-09 |
| CVE-2025-11111 | critical | 9.8 | No | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admi... | 2026-10-09 |
| CVE-2026-90461 | medium | 6.3 | No | OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) B... | 2026-10-09 |
| CVE-2026-107510 | critical | 9.1 | No | An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation. | 2026-10-09 |
| CVE-2026-89322 | high | 7.2 | No | Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allo... | 2026-10-09 |
| CVE-2026-106177 | medium | 6.4 | No | A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code exec... | 2026-10-09 |
| CVE-2026-105331 | not reported | — | No | Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the ag... | 2026-10-09 |
| CVE-2026-105816 | high | 8.0 | No | Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin di... | 2026-10-09 |
| CVE-2026-93678 | high | 7.6 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorizat... | 2026-10-09 |
| CVE-2026-93448 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation... | 2026-10-09 |
| CVE-2026-76061 | medium | 5.5 | No | A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or loc... | 2026-10-09 |
| CVE-2026-75962 | high | 7.2 | No | The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vu... | 2026-10-09 |
| CVE-2026-63692 | critical | 10.0 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauth... | 2026-10-09 |
| CVE-2026-15688 | not reported | — | No | Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a loca... | 2026-10-09 |
| CVE-2026-106450 | medium | 5.3 | No | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB... | 2026-10-09 |
| CVE-2026-106440 | high | 7.8 | No | Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper packag... | 2026-10-09 |