Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-33522 | medium | 5.3 | No | Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for... | 2026-10-26 |
| CVE-2026-33521 | high | 7.5 | No | There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker t... | 2026-10-26 |
| CVE-2026-33520 | medium | 6.1 | No | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthen... | 2026-10-26 |
| CVE-2026-116634 | medium | 5.9 | No | OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens vi... | 2026-10-26 |
| CVE-2026-116541 | medium | 5.9 | No | Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that o... | 2026-10-26 |
| CVE-2026-116385 | low | 3.5 | No | A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of... | 2026-10-26 |
| CVE-2026-116371 | medium | 6.3 | No | A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login.... | 2026-10-26 |
| CVE-2026-116368 | high | 7.3 | No | A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/... | 2026-10-26 |
| CVE-2026-115920 | medium | 6.2 | No | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape... | 2026-10-26 |
| CVE-2026-115919 | medium | 6.2 | No | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_... | 2026-10-26 |
| CVE-2026-115804 | medium | 6.4 | No | HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticate... | 2026-10-26 |
| CVE-2026-115909 | high | 7.5 | No | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mo... | 2026-10-26 |
| CVE-2026-115908 | high | 7.4 | No | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive... | 2026-10-26 |
| CVE-2026-115720 | medium | 5.0 | No | Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard... | 2026-10-26 |
| CVE-2026-115728 | high | 7.5 | No | @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an in... | 2026-10-26 |
| CVE-2026-115385 | medium | 6.2 | No | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation... | 2026-10-26 |
| CVE-2026-115381 | medium | 4.8 | No | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2... | 2026-10-26 |
| CVE-2026-115380 | medium | 4.0 | No | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI... | 2026-10-26 |
| CVE-2026-115366 | low | 2.6 | No | OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plu... | 2026-10-26 |
| CVE-2026-115349 | high | 7.5 | No | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mi... | 2026-10-26 |