Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82531 | high | 8.1 | No | Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during e... | 2026-10-06 |
| CVE-2026-56596 | low | 3.5 | No | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected... | 2026-10-06 |
| CVE-2026-80327 | not reported | — | No | An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2... | 2026-10-06 |
| CVE-2026-59358 | not reported | — | No | Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid u... | 2026-10-06 |
| CVE-2026-59357 | not reported | — | No | Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusi... | 2026-10-06 |
| CVE-2026-105782 | high | 7.5 | No | Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddleware... | 2026-10-06 |
| CVE-2026-103546 | medium | 4.3 | No | In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsMan... | 2026-10-06 |
| CVE-2026-0482 | not reported | — | No | In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow craf... | 2026-10-06 |
| CVE-2026-0461 | not reported | — | No | Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded... | 2026-10-06 |
| CVE-2026-105712 | low | 3.6 | No | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory... | 2026-10-06 |
| CVE-2026-19395 | not reported | — | No | In Qt for MCUs, a Text element that displays styled text halts the device if an tag in the text contains an attribute with an empty value. T... | 2026-10-06 |
| CVE-2026-105219 | high | 7.5 | No | Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser... | 2026-10-06 |
| CVE-2026-105216 | high | 7.4 | No | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services becaus... | 2026-10-06 |
| CVE-2026-105105 | critical | 9.8 | No | CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Cor... | 2026-10-06 |
| CVE-2026-104477 | medium | 6.1 | No | Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double... | 2026-10-06 |
| CVE-2026-12392 | medium | 5.3 | No | An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated... | 2026-10-06 |
| CVE-2026-104871 | not reported | — | No | The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine r... | 2026-10-06 |
| CVE-2026-16335 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary fi... | 2026-10-06 |
| CVE-2026-16338 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due... | 2026-10-06 |
| CVE-2026-84031 | critical | 9.0 | No | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of in... | 2026-10-06 |