Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65212 | not reported | — | No | Rejected reason: The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | 2026-10-26 |
| CVE-2026-65203 | not reported | — | No | Rejected reason: The reported issue could not be reproduced. This CVE ID is unused by the CNA. | 2026-10-26 |
| CVE-2026-65202 | not reported | — | No | Rejected reason: The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | 2026-10-26 |
| CVE-2026-115196 | medium | 5.4 | No | An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the applic... | 2026-10-26 |
| CVE-2026-115195 | medium | 6.5 | No | A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for seve... | 2026-10-26 |
| CVE-2026-115194 | medium | 6.5 | No | A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not re... | 2026-10-26 |
| CVE-2026-115193 | high | 8.2 | No | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields a... | 2026-10-26 |
| CVE-2026-115192 | high | 7.1 | No | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the... | 2026-10-26 |
| CVE-2026-115191 | high | 7.1 | No | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter... | 2026-10-26 |
| CVE-2026-115190 | high | 8.0 | No | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.... | 2026-10-26 |
| CVE-2026-115189 | high | 8.8 | No | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user... | 2026-10-26 |
| CVE-2026-115188 | critical | 9.9 | No | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, t... | 2026-10-26 |
| CVE-2026-111231 | high | 7.2 | No | Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml bec... | 2026-10-26 |
| CVE-2026-111226 | high | 7.2 | No | pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Acc... | 2026-10-26 |
| CVE-2026-111221 | high | 7.2 | No | Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 comm... | 2026-10-26 |
| CVE-2026-111216 | high | 7.2 | No | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges... | 2026-10-26 |
| CVE-2026-111124 | high | 7.1 | No | CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to... | 2026-10-26 |
| CVE-2026-110875 | medium | 6.1 | No | AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] arr... | 2026-10-26 |
| CVE-2026-110870 | medium | 5.3 | No | Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322... | 2026-10-26 |
| CVE-2026-110865 | high | 7.1 | No | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by p... | 2026-10-26 |