Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111164 | medium | 5.5 | No | UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction... | 2026-10-26 |
| CVE-2026-108456 | high | 7.7 | No | Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-103634 | medium | 5.3 | No | Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch:... | 2026-10-26 |
| CVE-2026-45772 | critical | 9.8 | No | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerab... | 2026-10-26 |
| CVE-2026-41553 | critical | 10.0 | No | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanit... | 2026-10-26 |
| CVE-2026-26191 | critical | 9.8 | No | Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow... | 2026-10-26 |
| CVE-2026-41315 | critical | 9.8 | No | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerabilit... | 2026-10-26 |
| CVE-2026-46470 | critical | 9.1 | No | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps f... | 2026-10-26 |
| CVE-2026-0258 | critical | 9.1 | No | A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthentica... | 2026-10-26 |
| CVE-2026-44015 | critical | 9.9 | No | Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forge... | 2026-10-26 |
| CVE-2026-20182 | critical | 10.0 | Listed | May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was di... | 2026-10-26 |
| CVE-2026-42897 | medium | 6.1 | Listed | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized att... | 2026-10-26 |
| CVE-2026-8398 | critical | 9.8 | Listed | A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)... | 2026-10-26 |
| CVE-2026-0257 | critical | 9.1 | Listed | Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to... | 2026-10-26 |
| CVE-2026-106631 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-10-26 |
| CVE-2026-115778 | high | 7.5 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.data... | 2026-10-26 |
| CVE-2026-111974 | medium | 5.3 | No | The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparin... | 2026-10-26 |
| CVE-2026-103300 | medium | 5.3 | No | The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely origin... | 2026-10-26 |
| CVE-2026-94295 | medium | 5.3 | No | The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originate... | 2026-10-26 |
| CVE-2026-115251 | high | 7.2 | No | The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPres... | 2026-10-26 |