Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110938 | not reported | — | No | In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during p... | 2026-10-26 |
| CVE-2026-111075 | not reported | — | No | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`,... | 2026-10-26 |
| CVE-2026-111074 | not reported | — | No | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When pro... | 2026-10-26 |
| CVE-2026-110690 | high | 7.5 | No | Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where t... | 2026-10-26 |
| CVE-2026-110256 | low | 3.7 | No | Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts... | 2026-10-26 |
| CVE-2026-110018 | high | 8.8 | No | The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable t... | 2026-10-26 |
| CVE-2026-10759 | medium | 5.5 | No | A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search... | 2026-10-26 |
| CVE-2026-109561 | medium | 4.2 | No | goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Appr... | 2026-10-26 |
| CVE-2026-102941 | high | 7.5 | No | The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61... | 2026-10-26 |
| CVE-2021-48012 | high | 8.2 | No | fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML cont... | 2026-10-26 |
| CVE-2026-98144 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdna_cmd_s... | 2026-10-26 |
| CVE-2026-98145 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain... | 2026-10-26 |
| CVE-2026-33821 | critical | 9.9 | No | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network... | 2026-10-26 |
| CVE-2026-27851 | critical | 9.1 | No | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabli... | 2026-10-26 |
| CVE-2026-43914 | critical | 9.8 | No | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows... | 2026-10-26 |
| CVE-2026-43995 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations direc... | 2026-10-26 |
| CVE-2026-43639 | critical | 9.1 | No | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary o... | 2026-10-26 |
| CVE-2026-42858 | critical | 9.9 | No | Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataVie... | 2026-10-26 |
| CVE-2026-44643 | critical | 10.0 | No | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a ma... | 2026-10-26 |
| CVE-2026-42608 | critical | 9.1 | No | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By ma... | 2026-10-26 |