Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-9158 | critical | 9.8 | No | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dang... | 2026-10-26 |
| CVE-2026-11718 | critical | 9.1 | No | An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.... | 2026-10-26 |
| CVE-2026-11717 | critical | 9.1 | No | An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.... | 2026-10-26 |
| CVE-2026-30803 | critical | 9.1 | No | Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. This issue affects Conne... | 2026-10-26 |
| CVE-2026-32967 | critical | 9.1 | No | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinSchedule... | 2026-10-26 |
| CVE-2026-44172 | critical | 9.1 | No | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated use... | 2026-10-26 |
| CVE-2026-44170 | critical | 9.8 | No | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to... | 2026-10-26 |
| CVE-2026-50086 | critical | 9.8 | No | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentica... | 2026-10-26 |
| CVE-2026-50085 | critical | 9.8 | No | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker withou... | 2026-10-26 |
| CVE-2026-50083 | critical | 9.8 | No | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-cod... | 2026-10-26 |
| CVE-2026-50628 | critical | 9.8 | No | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from... | 2026-10-26 |
| CVE-2026-50627 | critical | 9.1 | No | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a J... | 2026-10-26 |
| CVE-2026-45177 | critical | 9.1 | No | Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remot... | 2026-10-26 |
| CVE-2026-49261 | critical | 9.8 | No | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4... | 2026-10-26 |
| CVE-2026-11414 | critical | 9.8 | No | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is ident... | 2026-10-26 |
| CVE-2026-46389 | critical | 9.8 | No | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deploy... | 2026-10-26 |
| CVE-2026-19437 | critical | 9.8 | No | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | 2026-10-26 |
| CVE-2026-18832 | critical | 9.8 | No | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. | 2026-10-26 |
| CVE-2026-18716 | critical | 9.1 | No | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial... | 2026-10-26 |
| CVE-2026-18670 | critical | 9.1 | No | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive... | 2026-10-26 |