Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103692 | critical | 9.8 | No | The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticat... | 2026-10-08 |
| CVE-2026-103646 | critical | 9.8 | No | The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged... | 2026-10-08 |
| CVE-2026-103309 | high | 7.5 | No | The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputt... | 2026-10-08 |
| CVE-2026-14990 | critical | 9.3 | No | IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to... | 2026-10-08 |
| CVE-2026-106434 | medium | 4.3 | No | The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a dec... | 2026-10-08 |
| CVE-2026-106431 | medium | 5.7 | No | An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when... | 2026-10-08 |
| CVE-2026-106430 | medium | 5.9 | No | The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. Thi... | 2026-10-08 |
| CVE-2026-106429 | medium | 6.5 | No | An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the applicat... | 2026-10-08 |
| CVE-2026-106428 | low | 3.7 | No | An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when pro... | 2026-10-08 |
| CVE-2026-50055 | medium | 6.5 | No | A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve not... | 2026-10-08 |
| CVE-2026-50054 | high | 7.1 | No | An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant... | 2026-10-08 |
| CVE-2026-10631 | medium | 6.5 | No | An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with E... | 2026-10-08 |
| CVE-2026-107623 | medium | 4.3 | No | A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backcha... | 2026-10-08 |
| CVE-2026-107604 | medium | 4.9 | No | A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm adminis... | 2026-10-08 |
| CVE-2026-107275 | medium | 6.8 | No | @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore... | 2026-10-08 |
| CVE-2026-107466 | medium | 6.1 | No | A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuou... | 2026-10-08 |
| CVE-2026-102488 | not reported | — | No | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obta... | 2026-10-08 |
| CVE-2026-107315 | medium | 5.3 | No | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in... | 2026-10-08 |
| CVE-2026-107314 | medium | 5.9 | No | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property exclude... | 2026-10-08 |
| CVE-2026-107313 | medium | 4.2 | No | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first p... | 2026-10-08 |