Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102721 | not reported | — | No | A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path ch... | 2026-09-29 |
| CVE-2026-102720 | not reported | — | No | A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received me... | 2026-09-29 |
| CVE-2026-102719 | not reported | — | No | Predictable DTLS HelloVerifyRequest Cookie in NetX Secure | 2026-09-29 |
| CVE-2026-102718 | not reported | — | No | hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer si... | 2026-09-29 |
| CVE-2026-102716 | not reported | — | No | An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser ca... | 2026-09-29 |
| CVE-2026-102715 | not reported | — | No | Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores ea... | 2026-09-29 |
| CVE-2026-102714 | not reported | — | No | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whos... | 2026-09-29 |
| CVE-2026-102713 | not reported | — | No | The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and... | 2026-09-29 |
| CVE-2026-101091 | high | 7.1 | No | SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can... | 2026-09-29 |
| CVE-2026-88894 | medium | 5.4 | No | Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlik... | 2026-09-29 |
| CVE-2026-100691 | medium | 5.4 | No | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAn... | 2026-09-29 |
| CVE-2026-100692 | high | 7.5 | No | Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root... | 2026-09-29 |
| CVE-2026-61825 | high | 8.7 | No | code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a st... | 2026-09-29 |
| CVE-2026-77581 | high | 8.6 | No | BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/co... | 2026-09-29 |
| CVE-2026-45143 | critical | 9.0 | No | Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content with... | 2026-09-29 |
| CVE-2026-53459 | not reported | — | No | Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.... | 2026-09-29 |
| CVE-2026-55158 | critical | 9.1 | No | Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds... | 2026-09-29 |
| CVE-2026-94417 | medium | 5.3 | No | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for... | 2026-09-29 |
| CVE-2026-77285 | not reported | — | No | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets... | 2026-09-29 |
| CVE-2026-63132 | not reported | — | No | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go... | 2026-09-29 |