Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111551 | not reported | — | No | Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte... | 2026-10-28 |
| CVE-2026-112344 | medium | 6.8 | No | Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user... | 2026-10-28 |
| CVE-2026-112343 | high | 8.1 | No | Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permis... | 2026-10-28 |
| CVE-2026-114354 | not reported | — | No | Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 t... | 2026-10-28 |
| CVE-2026-114353 | not reported | — | No | Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0... | 2026-10-28 |
| CVE-2026-112407 | high | 8.8 | No | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authen... | 2026-10-28 |
| CVE-2026-112188 | not reported | — | No | MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration... | 2026-10-28 |
| CVE-2026-111496 | not reported | — | No | Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timesta... | 2026-10-28 |
| CVE-2026-109411 | high | 8.1 | No | An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access co... | 2026-10-28 |
| CVE-2026-111115 | not reported | — | No | Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTagged... | 2026-10-28 |
| CVE-2026-111108 | not reported | — | No | Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is c... | 2026-10-28 |
| CVE-2026-111073 | not reported | — | No | The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (de... | 2026-10-28 |
| CVE-2026-10632 | high | 8.7 | No | A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject Ja... | 2026-10-28 |
| CVE-2026-109682 | medium | 4.7 | No | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host withou... | 2026-10-28 |
| CVE-2026-109681 | medium | 4.7 | No | The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can sp... | 2026-10-28 |
| CVE-2025-58403 | not reported | — | No | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenti... | 2026-10-28 |
| CVE-2025-30054 | not reported | — | No | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but du... | 2026-10-28 |
| CVE-2025-30053 | not reported | — | No | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability w... | 2026-10-28 |
| CVE-2025-30052 | not reported | — | No | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client'... | 2026-10-28 |
| CVE-2025-30051 | not reported | — | No | The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl conf... | 2026-10-28 |