Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-14974 | critical | 9.8 | No | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deseriali... | 2026-10-23 |
| CVE-2026-16184 | critical | 9.8 | No | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated re... | 2026-10-23 |
| CVE-2026-5735 | critical | 9.8 | No | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presum... | 2026-10-23 |
| CVE-2026-5734 | critical | 9.8 | No | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs show... | 2026-10-23 |
| CVE-2026-35052 | critical | 9.8 | No | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting... | 2026-10-23 |
| CVE-2026-35047 | critical | 9.8 | No | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to uplo... | 2026-10-23 |
| CVE-2026-35044 | critical | 9.6 | No | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile g... | 2026-10-23 |
| CVE-2026-34989 | critical | 9.0 | No | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support... | 2026-10-23 |
| CVE-2026-34977 | critical | 9.8 | No | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optio... | 2026-10-23 |
| CVE-2023-29542 | critical | 9.8 | No | A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as... | 2026-10-23 |
| CVE-2023-2186 | critical | 9.8 | No | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message i... | 2026-10-23 |
| CVE-2023-30191 | critical | 9.8 | No | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). | 2026-10-23 |
| CVE-2023-24482 | critical | 9.8 | No | A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versi... | 2026-10-23 |
| CVE-2026-75507 | high | 7.5 | No | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMe... | 2026-10-23 |
| CVE-2026-78119 | medium | 6.3 | No | The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit l... | 2026-10-23 |
| CVE-2026-78118 | high | 7.0 | No | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from seve... | 2026-10-23 |
| CVE-2026-19947 | medium | 5.3 | No | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set().... | 2026-10-23 |
| CVE-2026-115247 | medium | 4.3 | No | A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. T... | 2026-10-23 |
| CVE-2026-114576 | low | 3.7 | No | A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The... | 2026-10-23 |
| CVE-2026-114441 | high | 7.3 | No | A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.ph... | 2026-10-23 |