Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-9198 | critical | 9.8 | Listed | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network ca... | 2026-10-24 |
| CVE-2026-9586 | critical | 9.8 | Listed | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content... | 2026-10-24 |
| CVE-2026-8983 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multip... | 2026-10-24 |
| CVE-2026-16441 | critical | 9.6 | No | In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstr... | 2026-10-24 |
| CVE-2026-16439 | critical | 9.1 | No | In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow. | 2026-10-24 |
| CVE-2026-111934 | low | 3.7 | No | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X... | 2026-10-24 |
| CVE-2026-111933 | low | 3.7 | No | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because... | 2026-10-24 |
| CVE-2025-71435 | medium | 4.2 | No | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token exp... | 2026-10-24 |
| CVE-2025-27897 | medium | 6.1 | No | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthentic... | 2026-10-24 |
| CVE-2026-8986 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A ma... | 2026-10-24 |
| CVE-2026-8985 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An... | 2026-10-24 |
| CVE-2026-8984 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002.... | 2026-10-24 |
| CVE-2026-65768 | critical | 9.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacke... | 2026-10-24 |
| CVE-2026-57104 | critical | 9.6 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attack... | 2026-10-24 |
| CVE-2026-62836 | critical | 10.0 | No | Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate... | 2026-10-24 |
| CVE-2026-54489 | critical | 9.8 | No | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulner... | 2026-10-24 |
| CVE-2026-64993 | critical | 9.1 | No | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated a... | 2026-10-24 |
| CVE-2026-69264 | critical | 9.8 | No | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code temp... | 2026-10-24 |
| CVE-2026-69263 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 bl... | 2026-10-24 |
| CVE-2026-69258 | critical | 9.1 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/pr... | 2026-10-24 |