Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111618 | medium | 5.3 | No | CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoi... | 2026-10-23 |
| CVE-2026-111613 | high | 7.5 | No | AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database conne... | 2026-10-23 |
| CVE-2026-111608 | medium | 4.2 | No | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other mer... | 2026-10-23 |
| CVE-2026-111603 | medium | 4.3 | No | PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access depa... | 2026-10-23 |
| CVE-2026-109219 | critical | 9.8 | No | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to... | 2026-10-23 |
| CVE-2026-10534 | critical | 9.8 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser. | 2026-10-23 |
| CVE-2026-13433 | critical | 9.6 | No | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update... | 2026-10-23 |
| CVE-2026-10543 | critical | 9.8 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. | 2026-10-23 |
| CVE-2026-17111 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow... | 2026-10-23 |
| CVE-2026-17276 | critical | 9.9 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handlin... | 2026-10-23 |
| CVE-2026-16860 | critical | 9.9 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path elemen... | 2026-10-23 |
| CVE-2026-13739 | critical | 9.8 | No | A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of... | 2026-10-23 |
| CVE-2026-13738 | critical | 9.8 | No | CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrad... | 2026-10-23 |
| CVE-2026-13737 | critical | 9.8 | No | CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved main... | 2026-10-23 |
| CVE-2026-42018 | high | 7.5 | Listed | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially... | 2026-10-23 |
| CVE-2026-98090 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs_init_n... | 2026-10-23 |
| CVE-2026-98094 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirty_lock IRQ-safe fbtft_mkdirty() can be reache... | 2026-10-23 |
| CVE-2026-98091 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When c... | 2026-10-23 |
| CVE-2026-98092 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() acp6x_pdm_dma_... | 2026-10-23 |
| CVE-2026-98093 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk... | 2026-10-23 |