Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-74049 | medium | 6.1 | No | Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.... | 2026-10-29 |
| CVE-2026-74048 | medium | 6.5 | No | Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIP... | 2026-10-29 |
| CVE-2026-60111 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-54866 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin | 2026-10-29 |
| CVE-2026-54858 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Printy | 2026-10-29 |
| CVE-2026-54853 | medium | 5.3 | No | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-29 |
| CVE-2026-61575 | medium | 4.7 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filen... | 2026-10-29 |
| CVE-2026-61573 | medium | 6.1 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without o... | 2026-10-29 |
| CVE-2026-57845 | high | 8.8 | No | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python cod... | 2026-10-29 |
| CVE-2026-55465 | medium | 5.3 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version... | 2026-10-29 |
| CVE-2026-55444 | medium | 5.3 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RS... | 2026-10-29 |
| CVE-2026-55606 | medium | 6.5 | No | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detect... | 2026-10-29 |
| CVE-2026-48200 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve... | 2026-10-29 |
| CVE-2026-54455 | high | 7.6 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, ac... | 2026-10-29 |
| CVE-2026-42690 | medium | 5.4 | No | Subscriber Broken Access Control in LearnPress | 2026-10-29 |
| CVE-2026-39737 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor j... | 2026-10-29 |
| CVE-2026-46651 | critical | 9.8 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version... | 2026-10-29 |
| CVE-2026-46531 | medium | 5.5 | No | Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenti... | 2026-10-29 |
| CVE-2026-34485 | high | 7.8 | No | Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the... | 2026-10-29 |
| CVE-2026-34484 | medium | 6.7 | No | Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface.... | 2026-10-29 |