Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51862 | critical | 9.1 | No | DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote... | 2026-10-07 |
| CVE-2026-51852 | high | 7.5 | No | agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The sav... | 2026-10-07 |
| CVE-2026-39730 | high | 7.1 | No | Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.Th... | 2026-10-07 |
| CVE-2026-106589 | low | 2.9 | No | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privile... | 2026-10-07 |
| CVE-2026-106547 | not reported | — | No | A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and p... | 2026-10-07 |
| CVE-2026-106032 | medium | 5.7 | No | Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit b... | 2026-10-07 |
| CVE-2026-105812 | critical | 9.0 | No | Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow... | 2026-10-07 |
| CVE-2026-105811 | medium | 6.5 | No | Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://git... | 2026-10-07 |
| CVE-2026-105488 | high | 7.1 | No | Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vau... | 2026-10-07 |
| CVE-2026-102255 | critical | 10.0 | No | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By... | 2026-10-07 |
| CVE-2026-102668 | medium | 5.3 | No | The Joyland AI app accepts any TLS certificates from any server without validation. | 2026-10-07 |
| CVE-2026-102667 | high | 8.3 | No | Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permi... | 2026-10-07 |
| CVE-2026-102666 | medium | 6.5 | No | The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST AP... | 2026-10-07 |
| CVE-2026-102141 | medium | 6.7 | No | Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a... | 2026-10-07 |
| CVE-2026-102100 | high | 8.7 | No | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks... | 2026-10-07 |
| CVE-2020-9493 | critical | 9.8 | No | A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. | 2026-10-07 |
| CVE-2026-13417 | medium | 4.3 | No | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.propertie... | 2026-10-07 |
| CVE-2026-14259 | medium | 4.3 | No | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions whe... | 2026-10-07 |
| CVE-2026-14344 | medium | 4.3 | No | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission... | 2026-10-07 |
| CVE-2026-106057 | high | 7.8 | No | patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters... | 2026-10-07 |