Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68954 | critical | 9.0 | No | The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vuln... | 2026-09-30 |
| CVE-2026-68068 | critical | 9.0 | No | The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-... | 2026-09-30 |
| CVE-2026-63713 | critical | 9.0 | No | The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulner... | 2026-09-30 |
| CVE-2026-61811 | medium | 6.5 | No | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14... | 2026-09-30 |
| CVE-2026-77423 | high | 7.5 | No | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlle... | 2026-09-30 |
| CVE-2026-77422 | high | 7.5 | No | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main... | 2026-09-30 |
| CVE-2026-77421 | medium | 6.5 | No | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode p... | 2026-09-30 |
| CVE-2026-102305 | medium | 5.4 | No | UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafte... | 2026-09-30 |
| CVE-2026-92700 | not reported | — | No | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.... | 2026-09-30 |
| CVE-2026-92284 | not reported | — | No | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving... | 2026-09-30 |
| CVE-2026-74221 | high | 8.2 | No | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server respons... | 2026-09-30 |
| CVE-2026-74220 | high | 8.2 | No | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memor... | 2026-09-30 |
| CVE-2026-71972 | medium | 5.9 | No | U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bm... | 2026-09-30 |
| CVE-2026-71971 | high | 8.2 | No | U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in... | 2026-09-30 |
| CVE-2026-100502 | medium | 5.0 | No | Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin... | 2026-09-30 |
| CVE-2026-100418 | medium | 5.3 | No | Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire c... | 2026-09-30 |
| CVE-2026-103229 | high | 7.3 | No | A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects... | 2026-09-30 |
| CVE-2026-93547 | not reported | — | No | A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet... | 2026-09-30 |
| CVE-2026-91860 | not reported | — | No | A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the appli... | 2026-09-30 |
| CVE-2026-95274 | high | 8.3 | No | Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proc... | 2026-09-30 |