Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12887 | not reported | — | No | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the sc... | 2026-10-27 |
| CVE-2026-102800 | not reported | — | No | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widg... | 2026-10-27 |
| CVE-2026-117466 | not reported | — | No | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. | 2026-10-27 |
| CVE-2026-117341 | not reported | — | No | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is... | 2026-10-27 |
| CVE-2026-116870 | not reported | — | No | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from... | 2026-10-27 |
| CVE-2026-111548 | not reported | — | No | A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticate... | 2026-10-27 |
| CVE-2026-85299 | not reported | — | No | A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prio... | 2026-10-27 |
| CVE-2026-102789 | not reported | — | No | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPost... | 2026-10-27 |
| CVE-2026-102788 | not reported | — | No | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by... | 2026-10-27 |
| CVE-2026-102787 | not reported | — | No | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | 2026-10-27 |
| CVE-2026-111461 | not reported | — | No | An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a... | 2026-10-27 |
| CVE-2026-111460 | not reported | — | No | A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote att... | 2026-10-27 |
| CVE-2026-111459 | not reported | — | No | An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthentica... | 2026-10-27 |
| CVE-2026-116838 | high | 8.8 | No | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found... | 2026-10-27 |
| CVE-2026-116837 | high | 8.8 | No | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, Solar... | 2026-10-27 |
| CVE-2026-116836 | high | 8.8 | No | A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnera... | 2026-10-27 |
| CVE-2026-57196 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-27 |
| CVE-2026-107147 | not reported | — | No | The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the l... | 2026-10-27 |
| CVE-2026-107146 | not reported | — | No | The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of ser... | 2026-10-27 |
| CVE-2026-107145 | not reported | — | No | The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting... | 2026-10-27 |