Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-42221 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker c... | 2026-10-26 |
| CVE-2026-26332 | critical | 10.0 | No | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitr... | 2026-10-26 |
| CVE-2026-25293 | critical | 9.8 | No | Buffer overflow due to incorrect authorization in PLC FW | 2026-10-26 |
| CVE-2026-0300 | critical | 9.8 | Listed | A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software all... | 2026-10-26 |
| CVE-2026-116199 | high | 8.1 | No | Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username... | 2026-10-26 |
| CVE-2026-116596 | not reported | — | No | Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService... | 2026-10-26 |
| CVE-2026-65184 | critical | 9.8 | No | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system(... | 2026-10-26 |
| CVE-2026-3322 | not reported | — | No | Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privilege... | 2026-10-26 |
| CVE-2026-116339 | high | 7.3 | No | A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1... | 2026-10-26 |
| CVE-2026-112345 | high | 8.1 | No | TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allow... | 2026-10-26 |
| CVE-2026-116275 | medium | 6.3 | No | A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/co... | 2026-10-26 |
| CVE-2026-116008 | medium | 4.3 | No | DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated... | 2026-10-26 |
| CVE-2026-116486 | medium | 4.5 | No | Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by expl... | 2026-10-26 |
| CVE-2026-111590 | not reported | — | No | A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, al... | 2026-10-26 |
| CVE-2026-107157 | not reported | — | No | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework. | 2026-10-26 |
| CVE-2026-96432 | not reported | — | No | A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and th... | 2026-10-26 |
| CVE-2026-116072 | medium | 5.4 | No | Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an att... | 2026-10-26 |
| CVE-2026-116020 | medium | 5.4 | No | BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access... | 2026-10-26 |
| CVE-2026-116011 | high | 7.5 | No | Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to cra... | 2026-10-26 |
| CVE-2026-115897 | not reported | — | No | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the... | 2026-10-26 |