Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-41900 | critical | 10.0 | No | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerab... | 2026-10-26 |
| CVE-2026-8034 | critical | 9.8 | No | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker t... | 2026-10-26 |
| CVE-2026-35435 | critical | 10.0 | No | Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-41691 | critical | 9.1 | No | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a s... | 2026-10-26 |
| CVE-2026-7413 | critical | 9.8 | No | A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to p... | 2026-10-26 |
| CVE-2026-7821 | critical | 9.1 | No | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to... | 2026-10-26 |
| CVE-2026-5788 | critical | 9.8 | No | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invok... | 2026-10-26 |
| CVE-2026-7372 | critical | 9.0 | No | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP requ... | 2026-10-26 |
| CVE-2026-42370 | critical | 9.8 | No | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP requ... | 2026-10-26 |
| CVE-2026-7690 | critical | 9.8 | No | A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. This issue affects the function set_sys_adm of the file /cgi-bin/... | 2026-10-26 |
| CVE-2026-26015 | critical | 9.8 | No | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsG... | 2026-10-26 |
| CVE-2026-41873 | critical | 9.8 | No | ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail... | 2026-10-26 |
| CVE-2026-87849 | medium | 4.3 | No | The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON valu... | 2026-10-26 |
| CVE-2026-84727 | medium | 5.4 | No | Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash... | 2026-10-26 |
| CVE-2026-74757 | high | 7.5 | No | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to ma... | 2026-10-26 |
| CVE-2026-81563 | high | 7.5 | No | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deall... | 2026-10-26 |
| CVE-2026-19667 | high | 7.5 | No | If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in... | 2026-10-26 |
| CVE-2026-41940 | critical | 9.8 | Listed | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote atta... | 2026-10-26 |
| CVE-2026-6973 | high | 7.2 | Listed | An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with admin... | 2026-10-26 |
| CVE-2026-42208 | critical | 9.8 | Listed | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a datab... | 2026-10-26 |