Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19585 | medium | 5.3 | No | HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directo... | 2026-10-08 |
| CVE-2026-102784 | not reported | — | No | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the... | 2026-10-08 |
| CVE-2026-102783 | not reported | — | No | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logi... | 2026-10-08 |
| CVE-2026-105820 | medium | 5.4 | No | Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned... | 2026-10-08 |
| CVE-2026-105818 | medium | 5.9 | No | Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificate... | 2026-10-08 |
| CVE-2026-107207 | high | 7.2 | No | LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated at... | 2026-10-08 |
| CVE-2026-107206 | critical | 9.4 | No | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticate... | 2026-10-08 |
| CVE-2026-107205 | high | 8.6 | No | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated att... | 2026-10-08 |
| CVE-2026-107204 | critical | 9.8 | No | LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by... | 2026-10-08 |
| CVE-2026-4894 | not reported | — | No | A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multi... | 2026-10-08 |
| CVE-2026-12260 | not reported | — | No | SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/au... | 2026-10-08 |
| CVE-2026-107459 | critical | 9.8 | No | The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS... | 2026-10-08 |
| CVE-2026-107361 | medium | 4.2 | No | The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHos... | 2026-10-08 |
| CVE-2026-107337 | high | 7.1 | No | The Malcolm kiosk Flask application exposes a POST /script_call/ | 2026-10-08 |
| CVE-2026-107336 | medium | 6.5 | No | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sens... | 2026-10-08 |
| CVE-2026-107334 | medium | 5.4 | No | Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /hta... | 2026-10-08 |
| CVE-2026-107333 | high | 8.1 | No | Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) a... | 2026-10-08 |
| CVE-2026-107589 | high | 7.5 | No | Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account... | 2026-10-08 |
| CVE-2026-107586 | medium | 4.3 | No | Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote aut... | 2026-10-08 |
| CVE-2026-107585 | medium | 5.3 | No | Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthe... | 2026-10-08 |