Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117694 | not reported | — | No | Rejected reason: Reserved in error; never associated with a vulnerability. | 2026-10-28 |
| CVE-2026-117693 | not reported | — | No | Rejected reason: Reserved in error; never associated with a vulnerability. | 2026-10-28 |
| CVE-2026-117692 | not reported | — | No | Rejected reason: Reserved in error; never associated with a vulnerability. | 2026-10-28 |
| CVE-2024-46507 | high | 7.3 | No | A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows atta... | 2026-10-28 |
| CVE-2024-45257 | high | 7.3 | No | A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on th... | 2026-10-28 |
| CVE-2024-33724 | medium | 5.4 | No | SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. | 2026-10-28 |
| CVE-2024-33722 | medium | 6.3 | No | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. | 2026-10-28 |
| CVE-2024-33288 | high | 7.3 | No | Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. | 2026-10-28 |
| CVE-2024-30167 | medium | 6.3 | No | /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P... | 2026-10-28 |
| CVE-2024-27686 | high | 7.5 | No | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted... | 2026-10-28 |
| CVE-2024-34324 | critical | 9.1 | No | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character... | 2026-10-28 |
| CVE-2024-34319 | medium | 6.5 | No | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the applic... | 2026-10-28 |
| CVE-2026-118008 | high | 8.8 | No | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | 2026-10-28 |
| CVE-2026-76305 | medium | 6.5 | No | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive o... | 2026-10-28 |
| CVE-2026-76301 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-28 |
| CVE-2026-118378 | high | 7.8 | No | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements b... | 2026-10-28 |
| CVE-2026-117606 | medium | 5.4 | No | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' regist... | 2026-10-28 |
| CVE-2026-115624 | medium | 5.3 | No | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi... | 2026-10-28 |
| CVE-2026-115207 | medium | 5.5 | No | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or... | 2026-10-28 |
| CVE-2026-114730 | high | 7.2 | No | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blockl... | 2026-10-28 |