Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65660 | high | 8.8 | Listed | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over... | 2026-10-26 |
| CVE-2026-114625 | critical | 9.9 | Listed | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functio... | 2026-10-26 |
| CVE-2012-20006 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-26 |
| CVE-2026-97255 | medium | 5.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting In... | 2026-10-26 |
| CVE-2026-97254 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-e... | 2026-10-26 |
| CVE-2026-97785 | critical | 10.0 | No | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-83938 | critical | 10.0 | No | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges... | 2026-10-26 |
| CVE-2026-80465 | high | 8.7 | No | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All v... | 2026-10-26 |
| CVE-2026-112865 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-e... | 2026-10-26 |
| CVE-2026-63633 | critical | 9.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls St... | 2026-10-26 |
| CVE-2026-55194 | critical | 9.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_cl... | 2026-10-26 |
| CVE-2026-55191 | critical | 9.8 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264... | 2026-10-26 |
| CVE-2026-44792 | critical | 9.0 | No | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git reposito... | 2026-10-26 |
| CVE-2026-44791 | critical | 9.9 | No | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create o... | 2026-10-26 |
| CVE-2026-44789 | critical | 9.9 | No | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create o... | 2026-10-26 |
| CVE-2026-54310 | critical | 9.9 | No | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify wo... | 2026-10-26 |
| CVE-2026-54309 | critical | 10.0 | No | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP... | 2026-10-26 |
| CVE-2026-49871 | critical | 9.3 | No | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker t... | 2026-10-26 |
| CVE-2026-44087 | critical | 9.1 | No | Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an... | 2026-10-26 |
| CVE-2026-50242 | critical | 9.8 | No | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via di... | 2026-10-26 |