Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95208 | high | 7.5 | No | An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of S... | 2026-10-08 |
| CVE-2026-93699 | not reported | — | No | Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. | 2026-10-08 |
| CVE-2026-107353 | medium | 6.5 | No | traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution th... | 2026-10-08 |
| CVE-2026-107608 | medium | 5.5 | No | Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-de... | 2026-10-08 |
| CVE-2026-107378 | not reported | — | No | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path contain... | 2026-10-08 |
| CVE-2026-105830 | high | 7.5 | No | league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table e... | 2026-10-08 |
| CVE-2026-107446 | medium | 6.8 | No | containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for... | 2026-10-08 |
| CVE-2026-87726 | low | 3.9 | No | Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an unt... | 2026-10-08 |
| CVE-2026-107363 | not reported | — | No | In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent... | 2026-10-08 |
| CVE-2026-34499 | not reported | — | No | Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issu... | 2026-10-08 |
| CVE-2026-106557 | high | 7.7 | No | Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did n... | 2026-10-08 |
| CVE-2026-33586 | not reported | — | No | Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail ser... | 2026-10-08 |
| CVE-2026-93034 | critical | 9.8 | No | SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payl... | 2026-10-08 |
| CVE-2026-66087 | high | 8.1 | No | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are no... | 2026-10-08 |
| CVE-2026-66084 | high | 8.1 | No | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are... | 2026-10-08 |
| CVE-2026-66082 | medium | 6.5 | No | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow s... | 2026-10-08 |
| CVE-2026-107706 | medium | 4.3 | No | Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only r... | 2026-10-08 |
| CVE-2026-107709 | high | 7.8 | No | A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` im... | 2026-10-08 |
| CVE-2026-106126 | critical | 9.9 | No | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-p... | 2026-10-08 |
| CVE-2022-36227 | critical | 9.8 | No | In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th... | 2026-10-08 |