Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82411 | medium | 6.5 | No | Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token... | 2026-10-29 |
| CVE-2026-80353 | high | 8.1 | No | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connec... | 2026-10-29 |
| CVE-2026-86467 | high | 8.8 | No | Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began i... | 2026-10-29 |
| CVE-2026-86977 | high | 7.5 | No | An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to... | 2026-10-29 |
| CVE-2026-86868 | critical | 9.1 | No | An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS... | 2026-10-29 |
| CVE-2026-62017 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Good Homes | 2026-10-29 |
| CVE-2026-62012 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Coinpress | 2026-10-29 |
| CVE-2026-62006 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Nuts | 2026-10-29 |
| CVE-2026-62001 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Marcell | 2026-10-29 |
| CVE-2026-61993 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. | 2026-10-29 |
| CVE-2026-76527 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-29 |
| CVE-2026-74049 | medium | 6.1 | No | Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.... | 2026-10-29 |
| CVE-2026-74048 | medium | 6.5 | No | Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIP... | 2026-10-29 |
| CVE-2026-60111 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-54866 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin | 2026-10-29 |
| CVE-2026-54858 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Printy | 2026-10-29 |
| CVE-2026-54853 | medium | 5.3 | No | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-29 |
| CVE-2026-61575 | medium | 4.7 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filen... | 2026-10-29 |
| CVE-2026-61573 | medium | 6.1 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without o... | 2026-10-29 |
| CVE-2026-57845 | high | 8.8 | No | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python cod... | 2026-10-29 |