Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13451 | high | 7.7 | No | A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vul... | 2026-10-28 |
| CVE-2026-17615 | high | 7.5 | No | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote fi... | 2026-10-28 |
| CVE-2026-33568 | critical | 9.1 | No | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.... | 2026-10-28 |
| CVE-2026-28763 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R... | 2026-10-28 |
| CVE-2026-118655 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Doubl... | 2026-10-28 |
| CVE-2026-118654 | medium | 5.9 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve... | 2026-10-28 |
| CVE-2026-118653 | medium | 5.3 | No | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Ec... | 2026-10-28 |
| CVE-2026-118652 | medium | 6.1 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a... | 2026-10-28 |
| CVE-2026-118651 | medium | 5.3 | No | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it t... | 2026-10-28 |
| CVE-2026-118650 | high | 7.5 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path d... | 2026-10-28 |
| CVE-2026-118266 | medium | 5.3 | No | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target fo... | 2026-10-28 |
| CVE-2026-117574 | critical | 9.1 | No | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request s... | 2026-10-28 |
| CVE-2026-116797 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.rend... | 2026-10-28 |
| CVE-2026-116593 | not reported | — | No | Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configuratio... | 2026-10-28 |
| CVE-2026-115786 | medium | 6.5 | No | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox... | 2026-10-28 |
| CVE-2026-115415 | medium | 6.5 | No | Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote acto... | 2026-10-28 |
| CVE-2026-115644 | not reported | — | No | Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a... | 2026-10-28 |
| CVE-2026-114357 | not reported | — | No | Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through... | 2026-10-28 |
| CVE-2026-114356 | not reported | — | No | Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Andr... | 2026-10-28 |
| CVE-2026-114355 | not reported | — | No | OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android... | 2026-10-28 |