Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12670 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory... | 2026-10-23 |
| CVE-2026-84682 | not reported | — | No | A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attack... | 2026-10-23 |
| CVE-2026-111653 | medium | 5.3 | No | 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's pr... | 2026-10-23 |
| CVE-2026-111648 | low | 2.7 | No | BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modi... | 2026-10-23 |
| CVE-2026-109433 | medium | 6.5 | No | Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows aut... | 2026-10-23 |
| CVE-2026-111643 | critical | 9.8 | No | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary c... | 2026-10-23 |
| CVE-2026-111638 | high | 7.7 | No | sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated... | 2026-10-23 |
| CVE-2026-115414 | high | 7.8 | No | OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration... | 2026-10-23 |
| CVE-2026-97635 | high | 8.1 | No | The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduc... | 2026-10-23 |
| CVE-2026-91664 | high | 7.5 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabilit... | 2026-10-23 |
| CVE-2026-12727 | medium | 4.3 | No | IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing spe... | 2026-10-23 |
| CVE-2026-14511 | medium | 6.5 | No | IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that cr... | 2026-10-23 |
| CVE-2026-115378 | medium | 5.8 | No | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that... | 2026-10-23 |
| CVE-2026-115374 | high | 7.1 | No | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL h... | 2026-10-23 |
| CVE-2026-115371 | high | 7.1 | No | Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted... | 2026-10-23 |
| CVE-2026-115370 | medium | 4.3 | No | Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted pro... | 2026-10-23 |
| CVE-2026-112778 | high | 8.8 | No | Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress... | 2026-10-23 |
| CVE-2026-112390 | high | 7.5 | No | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC im... | 2026-10-23 |
| CVE-2026-112391 | high | 7.5 | No | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested... | 2026-10-23 |
| CVE-2026-115547 | critical | 9.1 | No | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values.... | 2026-10-23 |