Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-41211 | critical | 10.0 | No | Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `... | 2026-10-26 |
| CVE-2026-26354 | critical | 9.8 | No | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version... | 2026-10-26 |
| CVE-2026-33608 | critical | 9.8 | No | An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update... | 2026-10-26 |
| CVE-2026-33598 | critical | 9.1 | No | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a... | 2026-10-26 |
| CVE-2026-6023 | critical | 9.8 | No | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization w... | 2026-10-26 |
| CVE-2026-41144 | critical | 9.8 | No | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to versio... | 2026-10-26 |
| CVE-2026-5845 | critical | 9.6 | No | An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authentica... | 2026-10-26 |
| CVE-2026-40910 | critical | 9.1 | No | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUse... | 2026-10-26 |
| CVE-2026-40892 | critical | 9.8 | No | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_... | 2026-10-26 |
| CVE-2026-6644 | critical | 9.1 | No | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out... | 2026-10-26 |
| CVE-2026-6643 | critical | 9.9 | No | A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and... | 2026-10-26 |
| CVE-2026-40487 | critical | 9.0 | No | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to uplo... | 2026-10-26 |
| CVE-2026-5720 | critical | 9.1 | No | miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service... | 2026-10-26 |
| CVE-2026-33689 | critical | 9.1 | No | xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message pa... | 2026-10-26 |
| CVE-2026-33516 | critical | 9.1 | No | xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange ph... | 2026-10-26 |
| CVE-2026-40518 | critical | 9.1 | No | ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent cre... | 2026-10-26 |
| CVE-2026-27820 | critical | 9.8 | No | zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a b... | 2026-10-26 |
| CVE-2026-5189 | critical | 9.8 | No | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker... | 2026-10-26 |
| CVE-2026-27303 | critical | 9.6 | No | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbi... | 2026-10-26 |
| CVE-2026-27245 | critical | 9.3 | No | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exp... | 2026-10-26 |