Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-10137 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2... | 2026-10-23 |
| CVE-2026-10136 | critical | 9.1 | No | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20... | 2026-10-23 |
| CVE-2026-10135 | critical | 9.1 | No | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).... | 2026-10-23 |
| CVE-2026-10133 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.... | 2026-10-23 |
| CVE-2026-10132 | critical | 9.1 | No | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B... | 2026-10-23 |
| CVE-2026-10131 | critical | 9.1 | No | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20... | 2026-10-23 |
| CVE-2026-105933 | not reported | — | No | Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_requi... | 2026-10-23 |
| CVE-2026-105932 | not reported | — | No | The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persi... | 2026-10-23 |
| CVE-2026-66321 | critical | 9.6 | No | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute... | 2026-10-23 |
| CVE-2026-21662 | critical | 9.8 | No | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This is... | 2026-10-23 |
| CVE-2026-17351 | critical | 9.0 | No | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, v... | 2026-10-23 |
| CVE-2026-14537 | critical | 9.8 | No | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthent... | 2026-10-23 |
| CVE-2026-65888 | critical | 9.8 | No | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any g... | 2026-10-23 |
| CVE-2026-65887 | critical | 9.8 | No | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to re... | 2026-10-23 |
| CVE-2026-65890 | critical | 9.8 | No | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to i... | 2026-10-23 |
| CVE-2026-65884 | critical | 9.8 | No | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, all... | 2026-10-23 |
| CVE-2026-65883 | critical | 9.8 | No | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field all... | 2026-10-23 |
| CVE-2026-58177 | critical | 9.8 | No | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache T... | 2026-10-23 |
| CVE-2026-33267 | critical | 9.1 | No | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from... | 2026-10-23 |
| CVE-2026-14976 | critical | 9.8 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0... | 2026-10-23 |