Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117574 | critical | 9.1 | No | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request s... | 2026-10-28 |
| CVE-2026-115786 | medium | 6.5 | No | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox... | 2026-10-28 |
| CVE-2026-114357 | not reported | — | No | Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through... | 2026-10-28 |
| CVE-2026-114356 | not reported | — | No | Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Andr... | 2026-10-28 |
| CVE-2026-114355 | not reported | — | No | OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android... | 2026-10-28 |
| CVE-2026-112344 | medium | 6.8 | No | Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user... | 2026-10-28 |
| CVE-2026-114354 | not reported | — | No | Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 t... | 2026-10-28 |
| CVE-2026-114353 | not reported | — | No | Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0... | 2026-10-28 |
| CVE-2026-112407 | high | 8.8 | No | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authen... | 2026-10-28 |
| CVE-2026-112188 | not reported | — | No | MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration... | 2026-10-28 |
| CVE-2026-10632 | high | 8.7 | No | A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject Ja... | 2026-10-28 |
| CVE-2026-109682 | medium | 4.7 | No | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host withou... | 2026-10-28 |
| CVE-2026-109681 | medium | 4.7 | No | The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can sp... | 2026-10-28 |
| CVE-2025-58403 | not reported | — | No | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenti... | 2026-10-28 |
| CVE-2025-30054 | not reported | — | No | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but du... | 2026-10-28 |
| CVE-2025-30053 | not reported | — | No | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability w... | 2026-10-28 |
| CVE-2025-30052 | not reported | — | No | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client'... | 2026-10-28 |
| CVE-2025-30051 | not reported | — | No | The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl conf... | 2026-10-28 |
| CVE-2025-30050 | not reported | — | No | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter... | 2026-10-28 |
| CVE-2025-30049 | not reported | — | No | The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 | 2026-10-28 |