Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-55125 | critical | 9.8 | No | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configurat... | 2026-10-07 |
| CVE-2025-14942 | critical | 9.8 | No | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signatu... | 2026-10-07 |
| CVE-2026-42638 | high | 7.5 | No | Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured... | 2026-10-07 |
| CVE-2026-42418 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rock... | 2026-10-07 |
| CVE-2026-81792 | medium | 6.5 | No | Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enq... | 2026-10-07 |
| CVE-2025-13392 | critical | 9.8 | No | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3... | 2026-10-07 |
| CVE-2025-40639 | critical | 9.8 | No | A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete data... | 2026-10-07 |
| CVE-2026-98164 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_wr... | 2026-10-07 |
| CVE-2026-56098 | medium | 4.3 | No | A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execu... | 2026-10-07 |
| CVE-2026-12545 | medium | 6.7 | No | A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component di... | 2026-10-07 |
| CVE-2026-12405 | high | 8.8 | No | A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_inv... | 2026-10-07 |
| CVE-2026-102375 | medium | 6.5 | No | Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels... | 2026-10-07 |
| CVE-2026-100507 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Co... | 2026-10-07 |
| CVE-2026-56952 | medium | 6.7 | No | In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could... | 2026-10-07 |
| CVE-2026-91140 | critical | 9.6 | No | An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector... | 2026-10-07 |
| CVE-2026-56906 | high | 7.0 | No | In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with... | 2026-10-07 |
| CVE-2026-55330 | critical | 9.8 | No | In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead... | 2026-10-07 |
| CVE-2026-105985 | high | 8.8 | No | Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any au... | 2026-10-07 |
| CVE-2026-101207 | high | 8.8 | No | Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Ele... | 2026-10-07 |
| CVE-2026-95264 | medium | 6.5 | No | Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files... | 2026-10-06 |