Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-80423 | medium | 6.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure... | 2026-10-06 |
| CVE-2026-81208 | high | 7.7 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of en... | 2026-10-06 |
| CVE-2026-81536 | high | 7.7 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML extern... | 2026-10-06 |
| CVE-2026-81537 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injectio... | 2026-10-06 |
| CVE-2026-81539 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutraliza... | 2026-10-06 |
| CVE-2026-81545 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutra... | 2026-10-06 |
| CVE-2026-81547 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal. | 2026-10-06 |
| CVE-2026-105762 | high | 8.3 | No | Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/r... | 2026-10-06 |
| CVE-2026-105761 | high | 7.1 | No | Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/... | 2026-10-06 |
| CVE-2026-104905 | high | 8.1 | No | FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authentica... | 2026-10-06 |
| CVE-2026-12171 | high | 7.8 | No | auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in p... | 2026-10-06 |
| CVE-2026-88397 | medium | 6.5 | No | ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter. | 2026-10-06 |
| CVE-2026-88395 | critical | 9.8 | No | GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter. | 2026-10-06 |
| CVE-2026-104891 | high | 7.5 | No | mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and... | 2026-10-06 |
| CVE-2026-89039 | medium | 6.5 | No | A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and recei... | 2026-10-06 |
| CVE-2026-88392 | high | 7.5 | No | Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code. | 2026-10-06 |
| CVE-2026-105295 | high | 7.5 | No | GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verificat... | 2026-10-06 |
| CVE-2026-105294 | high | 7.4 | No | Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key... | 2026-10-06 |
| CVE-2026-105293 | high | 8.1 | No | Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape t... | 2026-10-06 |
| CVE-2026-105223 | high | 7.4 | No | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a ku... | 2026-10-06 |