Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76718 | high | 8.2 | No | A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions. | 2026-09-29 |
| CVE-2026-11796 | not reported | — | No | Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleR... | 2026-09-29 |
| CVE-2026-12265 | high | 8.8 | No | Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to dest... | 2026-09-29 |
| CVE-2026-19444 | medium | 6.5 | No | A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a co... | 2026-09-29 |
| CVE-2026-12264 | high | 8.8 | No | Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to... | 2026-09-29 |
| CVE-2026-12269 | high | 8.8 | No | Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration work... | 2026-09-29 |
| CVE-2026-12268 | high | 8.8 | No | ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to re... | 2026-09-29 |
| CVE-2026-12267 | high | 7.2 | No | ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading t... | 2026-09-29 |
| CVE-2026-75553 | low | 2.4 | No | Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a... | 2026-09-29 |
| CVE-2026-102242 | not reported | — | No | Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 throu... | 2026-09-29 |
| CVE-2026-82973 | critical | 9.4 | No | Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticate... | 2026-09-29 |
| CVE-2026-102437 | high | 7.8 | No | OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a l... | 2026-09-29 |
| CVE-2026-97399 | low | 3.7 | No | The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size l... | 2026-09-29 |
| CVE-2026-81375 | not reported | — | No | A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cl... | 2026-09-29 |
| CVE-2026-19759 | not reported | — | No | An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on G... | 2026-09-29 |
| CVE-2026-87723 | not reported | — | No | In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-co... | 2026-09-29 |
| CVE-2026-100741 | critical | 9.8 | No | Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allow... | 2026-09-29 |
| CVE-2026-94445 | high | 8.8 | No | A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjo... | 2026-09-29 |
| CVE-2022-51019 | high | 8.8 | No | Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter... | 2026-09-29 |
| CVE-2026-7193 | not reported | — | No | A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the... | 2026-09-29 |