Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58662 | critical | 9.1 | No | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apac... | 2026-10-24 |
| CVE-2026-58023 | critical | 9.1 | No | Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended... | 2026-10-24 |
| CVE-2026-55971 | critical | 9.8 | No | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomme... | 2026-10-24 |
| CVE-2026-48144 | critical | 9.1 | No | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: bef... | 2026-10-24 |
| CVE-2026-58630 | critical | 9.8 | No | Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-62825 | critical | 9.8 | No | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-58275 | critical | 9.8 | No | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-56160 | critical | 9.9 | No | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-15967 | critical | 9.8 | No | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0... | 2026-10-24 |
| CVE-2026-15966 | critical | 9.8 | No | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfe... | 2026-10-24 |
| CVE-2026-10697 | critical | 9.8 | No | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 befor... | 2026-10-24 |
| CVE-2026-65906 | critical | 10.0 | No | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | 2026-10-24 |
| CVE-2026-64815 | critical | 9.8 | No | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | 2026-10-24 |
| CVE-2026-50252 | critical | 9.3 | No | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increase... | 2026-10-24 |
| CVE-2026-29009 | critical | 9.8 | No | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled... | 2026-10-24 |
| CVE-2026-35035 | critical | 9.0 | No | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support... | 2026-10-24 |
| CVE-2023-29131 | critical | 10.0 | No | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of an incorrect default value in the... | 2026-10-24 |
| CVE-2023-34844 | critical | 9.8 | No | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape. | 2026-10-24 |
| CVE-2021-25827 | critical | 9.8 | No | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. | 2026-10-24 |
| CVE-2022-44276 | critical | 9.8 | No | In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. | 2026-10-24 |