Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88877 | critical | 9.8 | No | Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles In... | 2026-10-08 |
| CVE-2026-87807 | high | 7.5 | No | siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query para... | 2026-10-08 |
| CVE-2026-86435 | high | 7.5 | No | commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate fo... | 2026-10-08 |
| CVE-2026-86434 | high | 7.5 | No | league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normal... | 2026-10-08 |
| CVE-2026-86433 | high | 7.5 | No | commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::... | 2026-10-08 |
| CVE-2026-86432 | medium | 5.3 | No | commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentati... | 2026-10-08 |
| CVE-2026-86431 | high | 7.2 | No | league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExte... | 2026-10-08 |
| CVE-2026-86430 | high | 7.5 | No | league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link la... | 2026-10-08 |
| CVE-2026-86429 | high | 7.5 | No | The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartP... | 2026-10-08 |
| CVE-2026-86204 | medium | 6.5 | No | PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to... | 2026-10-08 |
| CVE-2026-86203 | low | 3.7 | No | PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploi... | 2026-10-08 |
| CVE-2026-86202 | medium | 4.3 | No | PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigg... | 2026-10-08 |
| CVE-2026-86201 | high | 7.5 | No | PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknow... | 2026-10-08 |
| CVE-2026-86200 | medium | 5.3 | No | PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to fl... | 2026-10-08 |
| CVE-2026-86428 | high | 7.5 | No | commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly... | 2026-10-08 |
| CVE-2026-86197 | not reported | — | No | Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav... | 2026-10-08 |
| CVE-2026-85597 | critical | 9.1 | No | Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attack... | 2026-10-08 |
| CVE-2026-85596 | critical | 9.8 | No | Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generate... | 2026-10-08 |
| CVE-2026-85595 | critical | 9.8 | No | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middle... | 2026-10-08 |
| CVE-2026-85594 | critical | 9.8 | No | Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares S... | 2026-10-08 |