Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-11367 | critical | 9.8 | No | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization | 2026-10-23 |
| CVE-2025-11366 | critical | 9.8 | No | N-central < 2025.4 is vulnerable to authentication bypass via path traversal | 2026-10-23 |
| CVE-2025-34282 | critical | 9.1 | No | ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An... | 2026-10-23 |
| CVE-2025-40594 | critical | 9.8 | No | A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS... | 2026-10-23 |
| CVE-2025-6519 | critical | 9.8 | No | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictab... | 2026-10-23 |
| CVE-2025-34522 | critical | 9.8 | No | A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be tri... | 2026-10-23 |
| CVE-2025-71433 | high | 7.5 | No | Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying pr... | 2026-10-23 |
| CVE-2025-57739 | high | 8.8 | No | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet For... | 2026-10-23 |
| CVE-2026-97301 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | 2026-10-23 |
| CVE-2026-18577 | high | 8.1 | Listed | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | 2026-10-23 |
| CVE-2026-18556 | high | 7.4 | Listed | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects... | 2026-10-23 |
| CVE-2026-91419 | high | 7.8 | No | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported version that is affected... | 2026-10-23 |
| CVE-2026-91415 | high | 7.0 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Su... | 2026-10-23 |
| CVE-2026-57849 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-23 |
| CVE-2026-58497 | not reported | — | No | Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0... | 2026-10-23 |
| CVE-2026-55222 | medium | 5.1 | No | Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manual... | 2026-10-23 |
| CVE-2026-56837 | high | 8.6 | No | PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listene... | 2026-10-23 |
| CVE-2026-56833 | high | 7.5 | No | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem... | 2026-10-23 |
| CVE-2026-55835 | not reported | — | No | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to ve... | 2026-10-23 |
| CVE-2026-46346 | medium | 6.5 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password... | 2026-10-23 |