Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103378 | medium | 6.5 | No | The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its... | 2026-10-07 |
| CVE-2026-103323 | medium | 5.9 | No | The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpo... | 2026-10-07 |
| CVE-2026-58815 | high | 7.8 | No | In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of priv... | 2026-10-07 |
| CVE-2026-55280 | high | 8.8 | No | In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege... | 2026-10-07 |
| CVE-2026-65669 | critical | 9.6 | No | Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized atta... | 2026-10-07 |
| CVE-2026-65772 | high | 8.8 | No | Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | 2026-10-07 |
| CVE-2026-90996 | medium | 5.5 | No | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security S... | 2026-10-07 |
| CVE-2026-57173 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions c... | 2026-10-07 |
| CVE-2026-55286 | high | 7.8 | No | In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esc... | 2026-10-07 |
| CVE-2026-104944 | not reported | — | No | TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthentic... | 2026-10-07 |
| CVE-2026-69147 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can se... | 2026-10-07 |
| CVE-2026-102126 | high | 8.1 | No | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated... | 2026-10-07 |
| CVE-2026-102132 | high | 7.2 | No | An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged i... | 2026-10-07 |
| CVE-2026-102134 | medium | 5.4 | No | Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentic... | 2026-10-07 |
| CVE-2026-102123 | high | 7.4 | No | A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthentica... | 2026-10-07 |
| CVE-2026-102122 | medium | 4.3 | No | Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authentica... | 2026-10-07 |
| CVE-2026-102120 | high | 8.8 | No | A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl... | 2026-10-07 |
| CVE-2026-93026 | not reported | — | No | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus upd... | 2026-10-07 |
| CVE-2026-58069 | not reported | — | No | This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provide... | 2026-10-07 |
| CVE-2026-58068 | not reported | — | No | This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. | 2026-10-07 |