Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109176 | medium | 5.4 | No | MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other adm... | 2026-10-26 |
| CVE-2026-109171 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject c... | 2026-10-26 |
| CVE-2026-109164 | high | 7.1 | No | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other use... | 2026-10-26 |
| CVE-2025-2708 | critical | 9.1 | No | A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/uploa... | 2026-10-26 |
| CVE-2025-2707 | critical | 9.1 | No | A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload... | 2026-10-26 |
| CVE-2026-105773 | high | 7.0 | No | Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a... | 2026-10-26 |
| CVE-2020-37282 | critical | 9.8 | No | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a craft... | 2026-10-26 |
| CVE-2026-77062 | not reported | — | No | The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malici... | 2026-10-26 |
| CVE-2026-77061 | not reported | — | No | boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can re... | 2026-10-26 |
| CVE-2026-77060 | not reported | — | No | boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any loca... | 2026-10-26 |
| CVE-2026-77059 | not reported | — | No | boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.... | 2026-10-26 |
| CVE-2026-112250 | medium | 4.4 | No | A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the passwor... | 2026-10-26 |
| CVE-2026-42584 | critical | 9.1 | No | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each in... | 2026-10-26 |
| CVE-2026-0264 | critical | 9.8 | No | A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated at... | 2026-10-26 |
| CVE-2026-0263 | critical | 9.8 | No | A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attac... | 2026-10-26 |
| CVE-2026-116073 | medium | 6.5 | No | Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside... | 2026-10-26 |
| CVE-2026-97200 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exha... | 2026-10-26 |
| CVE-2026-115269 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthentic... | 2026-10-26 |
| CVE-2026-114216 | not reported | — | No | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrude... | 2026-10-26 |
| CVE-2026-114213 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthen... | 2026-10-26 |