Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-40469 | critical | 9.1 | No | Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite... | 2026-10-24 |
| CVE-2026-40468 | critical | 9.1 | No | Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting o... | 2026-10-24 |
| CVE-2026-57830 | critical | 9.1 | No | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate... | 2026-10-24 |
| CVE-2026-56453 | critical | 9.8 | No | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the c... | 2026-10-24 |
| CVE-2026-54052 | critical | 9.9 | No | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP... | 2026-10-24 |
| CVE-2026-20157 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehen... | 2026-10-24 |
| CVE-2026-20156 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehen... | 2026-10-24 |
| CVE-2026-24227 | critical | 9.8 | No | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vuln... | 2026-10-24 |
| CVE-2026-58617 | critical | 9.8 | No | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-54433 | critical | 10.0 | No | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message... | 2026-10-24 |
| CVE-2026-54058 | critical | 9.1 | No | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap ra... | 2026-10-24 |
| CVE-2026-62644 | critical | 9.8 | No | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via... | 2026-10-24 |
| CVE-2026-62643 | critical | 10.0 | No | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma... | 2026-10-24 |
| CVE-2026-59836 | critical | 9.8 | No | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiCli... | 2026-10-24 |
| CVE-2026-62392 | critical | 9.8 | No | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may... | 2026-10-24 |
| CVE-2026-62390 | critical | 9.8 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing... | 2026-10-24 |
| CVE-2026-62422 | critical | 9.8 | No | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass v... | 2026-10-24 |
| CVE-2026-58319 | critical | 9.1 | No | Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with networ... | 2026-10-24 |
| CVE-2026-15410 | high | 7.2 | Listed | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Man... | 2026-10-24 |
| CVE-2026-15409 | critical | 10.0 | Listed | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticat... | 2026-10-24 |