Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-26287 | high | 7.1 | No | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting... | 2026-10-06 |
| CVE-2026-105845 | critical | 9.8 | No | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-... | 2026-10-06 |
| CVE-2026-105806 | not reported | — | No | Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authen... | 2026-10-06 |
| CVE-2026-105805 | not reported | — | No | Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27,... | 2026-10-06 |
| CVE-2026-105804 | not reported | — | No | Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0... | 2026-10-06 |
| CVE-2026-90441 | high | 8.1 | No | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil... | 2026-10-06 |
| CVE-2026-103099 | high | 7.5 | No | Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a s... | 2026-10-06 |
| CVE-2026-67421 | medium | 6.8 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an... | 2026-10-06 |
| CVE-2026-100647 | high | 7.5 | No | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropi... | 2026-10-06 |
| CVE-2026-100648 | medium | 5.3 | No | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated client... | 2026-10-06 |
| CVE-2026-100649 | medium | 5.3 | No | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allo... | 2026-10-06 |
| CVE-2026-100650 | medium | 6.5 | No | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO... | 2026-10-06 |
| CVE-2026-100651 | medium | 6.5 | No | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the... | 2026-10-06 |
| CVE-2026-100652 | high | 7.5 | No | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-... | 2026-10-06 |
| CVE-2026-9032 | not reported | — | No | Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable witho... | 2026-10-06 |
| CVE-2026-105764 | not reported | — | No | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload S... | 2026-10-06 |
| CVE-2026-105740 | critical | 9.9 | No | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve R... | 2026-10-06 |
| CVE-2026-103957 | medium | 6.2 | No | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain... | 2026-10-06 |
| CVE-2026-104914 | not reported | — | No | MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries... | 2026-10-06 |
| CVE-2026-103446 | not reported | — | No | Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authenticat... | 2026-10-06 |