Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107092 | critical | 9.8 | No | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. | 2026-10-29 |
| CVE-2026-107686 | medium | 4.3 | No | The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access,... | 2026-10-29 |
| CVE-2026-101974 | medium | 6.5 | No | An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjac... | 2026-10-29 |
| CVE-2025-52097 | medium | 5.4 | No | Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting u... | 2026-10-29 |
| CVE-2026-66281 | high | 7.5 | No | In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop)... | 2026-10-29 |
| CVE-2026-66282 | high | 7.5 | No | In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its... | 2026-10-29 |
| CVE-2026-85079 | critical | 9.8 | No | In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code... | 2026-10-29 |
| CVE-2026-85080 | critical | 9.1 | No | In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited nu... | 2026-10-29 |
| CVE-2026-94502 | critical | 9.8 | No | In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote... | 2026-10-29 |
| CVE-2026-75508 | high | 7.5 | No | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limi... | 2026-10-29 |
| CVE-2026-61791 | high | 7.4 | No | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior... | 2026-10-29 |
| CVE-2026-25439 | high | 8.1 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This iss... | 2026-10-29 |
| CVE-2026-39746 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows B... | 2026-10-29 |
| CVE-2026-115373 | medium | 6.3 | No | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid}... | 2026-10-29 |
| CVE-2026-115369 | low | 2.2 | No | OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans... | 2026-10-29 |
| CVE-2026-115363 | low | 3.3 | No | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key val... | 2026-10-29 |
| CVE-2026-115359 | low | 3.7 | No | OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with... | 2026-10-29 |
| CVE-2026-115411 | medium | 5.0 | No | crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block... | 2026-10-29 |
| CVE-2026-115351 | medium | 4.7 | No | Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary... | 2026-10-29 |
| CVE-2026-114608 | not reported | — | No | Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME... | 2026-10-29 |