Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93523 | high | 7.8 | No | A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XW... | 2026-10-29 |
| CVE-2026-83525 | not reported | — | No | Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all pl... | 2026-10-29 |
| CVE-2026-118581 | medium | 6.5 | No | A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees... | 2026-10-29 |
| CVE-2026-118510 | high | 8.8 | No | A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related r... | 2026-10-29 |
| CVE-2026-117626 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for worksp... | 2026-10-29 |
| CVE-2026-117625 | not reported | — | No | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the... | 2026-10-29 |
| CVE-2026-117624 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as... | 2026-10-29 |
| CVE-2026-117623 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, r... | 2026-10-29 |
| CVE-2026-117622 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the c... | 2026-10-29 |
| CVE-2026-117621 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file an... | 2026-10-29 |
| CVE-2026-117620 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data... | 2026-10-29 |
| CVE-2026-117619 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke... | 2026-10-29 |
| CVE-2026-117618 | not reported | — | No | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu... | 2026-10-29 |
| CVE-2026-117617 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its paren... | 2026-10-29 |
| CVE-2026-117616 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing... | 2026-10-29 |
| CVE-2026-117615 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing atta... | 2026-10-29 |
| CVE-2026-117614 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the... | 2026-10-29 |
| CVE-2026-117613 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers wit... | 2026-10-29 |
| CVE-2026-117612 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attr... | 2026-10-29 |
| CVE-2026-116593 | not reported | — | No | Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configuratio... | 2026-10-29 |