Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-11541 | critical | 9.8 | No | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Appl... | 2026-10-25 |
| CVE-2026-7663 | critical | 9.8 | No | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operati... | 2026-10-25 |
| CVE-2026-13773 | critical | 10.0 | No | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar... | 2026-10-25 |
| CVE-2026-13772 | critical | 9.9 | No | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName... | 2026-10-25 |
| CVE-2026-13449 | critical | 9.1 | No | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when proces... | 2026-10-25 |
| CVE-2026-11714 | critical | 9.8 | No | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enable... | 2026-10-25 |
| CVE-2026-11546 | critical | 9.8 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adm... | 2026-10-25 |
| CVE-2026-10560 | critical | 9.1 | No | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an u... | 2026-10-25 |
| CVE-2026-14241 | critical | 9.8 | No | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effor... | 2026-10-25 |
| CVE-2026-11720 | critical | 9.1 | No | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, th... | 2026-10-25 |
| CVE-2026-13751 | critical | 9.6 | No | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statem... | 2026-10-25 |
| CVE-2026-48282 | critical | 10.0 | Listed | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traver... | 2026-10-25 |
| CVE-2026-56290 | critical | 9.8 | Listed | Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is... | 2026-10-25 |
| CVE-2026-3144 | critical | 9.8 | No | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the applicat... | 2026-10-25 |
| CVE-2026-58480 | critical | 9.8 | No | Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attacke... | 2026-10-25 |
| CVE-2026-60002 | critical | 9.4 | No | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only... | 2026-10-25 |
| CVE-2026-13020 | critical | 9.8 | No | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and K... | 2026-10-25 |
| CVE-2026-70197 | high | 8.1 | No | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | 2026-10-25 |
| CVE-2026-102870 | high | 8.8 | No | Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | 2026-10-25 |
| CVE-2026-58459 | critical | 9.6 | No | gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who contro... | 2026-10-25 |