Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102511 | not reported | — | No | Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an... | 2026-09-30 |
| CVE-2026-101033 | medium | 4.3 | No | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated a... | 2026-09-30 |
| CVE-2026-62813 | high | 7.5 | No | Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network. | 2026-09-30 |
| CVE-2026-62810 | high | 7.8 | No | Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-17413 | medium | 5.1 | No | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3... | 2026-09-30 |
| CVE-2026-17503 | medium | 5.1 | No | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3... | 2026-09-30 |
| CVE-2026-17511 | low | 3.4 | No | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3... | 2026-09-30 |
| CVE-2026-18857 | low | 3.4 | No | IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the... | 2026-09-30 |
| CVE-2026-97150 | high | 7.2 | No | When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP co... | 2026-09-30 |
| CVE-2026-92871 | high | 7.5 | No | A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of t... | 2026-09-30 |
| CVE-2026-78229 | medium | 6.7 | No | Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affect... | 2026-09-30 |
| CVE-2026-91191 | high | 7.5 | No | The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot pro... | 2026-09-30 |
| CVE-2026-84409 | high | 7.5 | No | The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metada... | 2026-09-30 |
| CVE-2026-72510 | critical | 9.0 | No | The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection. | 2026-09-30 |
| CVE-2026-72507 | critical | 9.0 | No | The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind S... | 2026-09-30 |
| CVE-2026-71379 | critical | 10.0 | No | The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. | 2026-09-30 |
| CVE-2026-71302 | high | 7.1 | No | The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attack... | 2026-09-30 |
| CVE-2026-71189 | low | 3.5 | No | An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to exec... | 2026-09-30 |
| CVE-2026-70356 | critical | 9.1 | No | The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP f... | 2026-09-30 |
| CVE-2026-69662 | low | 3.7 | No | The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. | 2026-09-30 |