Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105937 | not reported | — | No | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The sourc... | 2026-10-23 |
| CVE-2026-105936 | not reported | — | No | The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worke... | 2026-10-23 |
| CVE-2022-51025 | medium | 6.5 | No | Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitr... | 2026-10-23 |
| CVE-2022-51021 | high | 8.2 | No | NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers... | 2026-10-23 |
| CVE-2021-48014 | critical | 9.8 | No | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated... | 2026-10-23 |
| CVE-2019-25778 | high | 8.2 | No | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by in... | 2026-10-23 |
| CVE-2026-105935 | not reported | — | No | The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the fu... | 2026-10-23 |
| CVE-2026-105934 | not reported | — | No | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace... | 2026-10-23 |
| CVE-2017-20289 | high | 7.5 | No | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users... | 2026-10-23 |
| CVE-2026-67208 | critical | 9.8 | No | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS com... | 2026-10-23 |
| CVE-2026-66756 | critical | 9.8 | No | Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1.... | 2026-10-23 |
| CVE-2026-12118 | critical | 9.8 | No | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due... | 2026-10-23 |
| CVE-2026-4978 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System al... | 2026-10-23 |
| CVE-2026-14522 | critical | 9.8 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary com... | 2026-10-23 |
| CVE-2026-17544 | critical | 9.8 | No | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8... | 2026-10-23 |
| CVE-2026-17543 | critical | 9.8 | No | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2... | 2026-10-23 |
| CVE-2026-48449 | critical | 9.8 | No | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the co... | 2026-10-23 |
| CVE-2026-46749 | critical | 9.8 | No | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implem... | 2026-10-23 |
| CVE-2026-5300 | critical | 9.1 | No | Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensiti... | 2026-10-23 |
| CVE-2025-40938 | critical | 9.8 | No | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firm... | 2026-10-23 |