Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-42238 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/res... | 2026-10-25 |
| CVE-2026-40088 | critical | 9.6 | No | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-con... | 2026-10-25 |
| CVE-2026-0643 | critical | 9.8 | No | A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?... | 2026-10-25 |
| CVE-2026-7473 | medium | 5.8 | Listed | On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or... | 2026-10-25 |
| CVE-2026-55255 | high | 8.4 | Listed | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vu... | 2026-10-25 |
| CVE-2026-48908 | critical | 9.8 | Listed | A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and... | 2026-10-25 |
| CVE-2026-48939 | critical | 9.8 | Listed | A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulti... | 2026-10-25 |
| CVE-2026-7273 | high | 8.8 | Listed | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a... | 2026-10-25 |
| CVE-2026-57926 | critical | 9.8 | No | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack | 2026-10-25 |
| CVE-2026-53914 | critical | 9.8 | No | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | 2026-10-25 |
| CVE-2026-2053 | critical | 10.0 | No | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-contro... | 2026-10-25 |
| CVE-2026-48930 | critical | 9.8 | No | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation i... | 2026-10-25 |
| CVE-2026-54030 | critical | 9.3 | No | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not va... | 2026-10-25 |
| CVE-2026-54906 | critical | 9.8 | No | concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that th... | 2026-10-25 |
| CVE-2026-47898 | critical | 9.8 | No | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue a... | 2026-10-25 |
| CVE-2026-41106 | critical | 9.3 | No | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. | 2026-10-25 |
| CVE-2026-26145 | critical | 9.8 | No | Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. | 2026-10-25 |
| CVE-2026-59092 | critical | 9.8 | No | JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers... | 2026-10-25 |
| CVE-2026-55115 | critical | 9.9 | No | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Applicat... | 2026-10-25 |
| CVE-2026-54408 | critical | 9.8 | No | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by... | 2026-10-25 |