Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-17556 | critical | 9.1 | No | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files... | 2026-10-23 |
| CVE-2026-17617 | critical | 9.8 | No | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of UR... | 2026-10-23 |
| CVE-2026-10025 | critical | 9.8 | No | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability.... | 2026-10-23 |
| CVE-2026-68980 | critical | 9.1 | No | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The... | 2026-10-23 |
| CVE-2026-68979 | critical | 9.8 | No | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on compone... | 2026-10-23 |
| CVE-2026-18614 | critical | 9.8 | No | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the... | 2026-10-23 |
| CVE-2026-41452 | critical | 9.8 | No | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to... | 2026-10-23 |
| CVE-2026-18602 | critical | 9.8 | No | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-... | 2026-10-23 |
| CVE-2026-12155 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigge... | 2026-10-23 |
| CVE-2026-12148 | high | 8.8 | No | IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted... | 2026-10-23 |
| CVE-2026-11831 | medium | 5.4 | No | IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory l... | 2026-10-23 |
| CVE-2026-11829 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. | 2026-10-23 |
| CVE-2026-110839 | high | 7.1 | No | FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg beca... | 2026-10-23 |
| CVE-2026-110834 | medium | 6.5 | No | FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sen... | 2026-10-23 |
| CVE-2026-110835 | medium | 5.8 | No | FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: ms... | 2026-10-23 |
| CVE-2026-110836 | medium | 6.5 | No | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust c... | 2026-10-23 |
| CVE-2026-110837 | high | 7.1 | No | FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp... | 2026-10-23 |
| CVE-2026-110838 | high | 7.5 | No | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthe... | 2026-10-23 |
| CVE-2026-110833 | high | 7.5 | No | FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the... | 2026-10-23 |
| CVE-2026-110832 | medium | 6.5 | No | FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients... | 2026-10-23 |