Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12342 | critical | 9.6 | No | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due... | 2026-09-30 |
| CVE-2026-101044 | high | 7.1 | No | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate... | 2026-09-30 |
| CVE-2026-101043 | high | 7.4 | No | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy,... | 2026-09-30 |
| CVE-2026-101042 | medium | 6.4 | No | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication a... | 2026-09-30 |
| CVE-2026-100704 | high | 7.7 | No | Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evalua... | 2026-09-30 |
| CVE-2026-100632 | medium | 6.5 | No | Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the... | 2026-09-30 |
| CVE-2026-100631 | high | 7.5 | No | Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device to... | 2026-09-30 |
| CVE-2026-78902 | medium | 6.1 | No | Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG packa... | 2026-09-30 |
| CVE-2026-51773 | high | 8.1 | No | An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image locat... | 2026-09-30 |
| CVE-2026-51772 | medium | 6.5 | No | A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations config... | 2026-09-30 |
| CVE-2026-97731 | high | 7.1 | No | MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders... | 2026-09-30 |
| CVE-2026-97730 | high | 8.5 | No | In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) wi... | 2026-09-30 |
| CVE-2026-57179 | medium | 4.2 | No | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted... | 2026-09-30 |
| CVE-2026-55632 | medium | 4.3 | No | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pip... | 2026-09-30 |
| CVE-2026-54355 | not reported | — | No | MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&RE... | 2026-09-30 |
| CVE-2026-92873 | high | 7.3 | No | Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arb... | 2026-09-30 |
| CVE-2026-92872 | medium | 4.3 | No | Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information. | 2026-09-30 |
| CVE-2026-92867 | high | 8.8 | No | An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination o... | 2026-09-30 |
| CVE-2026-94952 | critical | 9.8 | No | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It... | 2026-09-30 |
| CVE-2026-81310 | medium | 6.6 | No | Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is in... | 2026-09-30 |