Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-53920 | not reported | — | No | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCP... | 2026-10-23 |
| CVE-2026-115570 | high | 7.4 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, a... | 2026-10-23 |
| CVE-2026-115537 | medium | 4.3 | No | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function s... | 2026-10-23 |
| CVE-2026-115534 | medium | 4.3 | No | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function ki... | 2026-10-23 |
| CVE-2026-115360 | medium | 4.7 | No | OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to Open... | 2026-10-23 |
| CVE-2026-115352 | high | 7.5 | No | Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exh... | 2026-10-23 |
| CVE-2026-112342 | high | 7.1 | No | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users t... | 2026-10-23 |
| CVE-2026-112330 | high | 7.5 | No | Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to cras... | 2026-10-23 |
| CVE-2026-115348 | high | 7.5 | No | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that a... | 2026-10-23 |
| CVE-2026-114613 | high | 7.5 | No | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leak... | 2026-10-23 |
| CVE-2026-17556 | critical | 9.1 | No | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files... | 2026-10-23 |
| CVE-2026-17617 | critical | 9.8 | No | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of UR... | 2026-10-23 |
| CVE-2026-10025 | critical | 9.8 | No | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability.... | 2026-10-23 |
| CVE-2026-68980 | critical | 9.1 | No | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The... | 2026-10-23 |
| CVE-2026-68979 | critical | 9.8 | No | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on compone... | 2026-10-23 |
| CVE-2026-18614 | critical | 9.8 | No | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the... | 2026-10-23 |
| CVE-2026-41452 | critical | 9.8 | No | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to... | 2026-10-23 |
| CVE-2026-18602 | critical | 9.8 | No | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-... | 2026-10-23 |
| CVE-2026-12155 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigge... | 2026-10-23 |
| CVE-2026-12148 | high | 8.8 | No | IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted... | 2026-10-23 |